<!-- BusyBot node reference — https://busybot.net/tools/core-webhook/ -->

> Node: Webhook (`core_webhook`) · Webhook trigger · v1
> Category: Core Nodes · Credentials: none
> Updated: 2026-08-16

# Webhook

> Start workflow from HTTP webhook

## Overview

Starts a workflow when an external HTTP request hits the webhook URL. Supports GET, POST, PUT, PATCH, DELETE methods with configurable authentication and response modes.

**Category:** Core Nodes  
**Tool Name:** `core_webhook`  
**Version:** 1

**Appearance:** Icon: `webhook` | Color: `#8b5cf6`

## Node Type

**Trigger** — webhook (receives incoming HTTP callbacks)

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | None (trigger node) |
| Output | `Output` |

## Credentials

This tool does not require any credentials.

### Parameters

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| HTTP Method | `options` | No | `POST` | The HTTP method to listen for. |
| | | | | Options: `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `*` (All — accepts any method) |
| Path | `string` | No | — | Custom webhook path suffix. Leave empty for auto-generated path. |
| Authentication | `options` | No | `none` | Authentication method for incoming requests. |
| | | | | Options: `none`, `basicAuth`, `headerAuth` |
| Username | `string` | No | — | Username for Basic Auth. _(shown when Authentication is `basicAuth`)_ |
| Password | `string` | No | — | Password for Basic Auth. _(shown when Authentication is `basicAuth`)_ |
| Header Name | `string` | No | `x-webhook-token` | Name of the header to check. _(shown when Authentication is `headerAuth`)_ |
| Header Value | `string` | No | — | Expected value of the auth header. _(shown when Authentication is `headerAuth`)_ |
| Response Mode | `options` | No | `onReceived` | When to send the HTTP response. |
| | | | | Options: `onReceived` (Immediately — reply as soon as the request is accepted) |
| Response Code | `number` | No | `200` | HTTP status code for the response. _(shown when Response Mode is `onReceived`)_ |
| Response Data | `options` | No | `firstEntryJson` | What data to include in the response. |
| | | | | Options: `firstEntryJson` (First Entry JSON — returns the first data entry as JSON), `noData` (No Response Body — returns an empty response body) |
| Bot Detection | `boolean` | No | `false` | Block requests from known bots and crawlers (uses User-Agent detection). |

## Output Data

Each incoming request produces one output item describing that request:

- `headers` — the request headers
- `params` — the route parameters
- `query` — the query-string parameters
- `body` — the parsed request body
- `method` — the HTTP method the caller used
- `url` — the requested URL
- `_trigger` — always `webhook`
- `_timestamp` — ISO 8601 timestamp of when the request arrived

Reference the payload downstream by expression, e.g. `{{ $json.body.orderId }}`.

## Usage Examples

- trigger workflow from an API call
- listen for incoming webhooks
- start when an HTTP POST is received
- receive data from an external service

## Example Configuration

Basic webhook with no authentication:

```json
{
  "id": "webhook-node",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "my-webhook",
    "authentication": "none",
    "responseMode": "onReceived",
    "botDetection": false,
    "responseCode": 200,
    "responseData": "firstEntryJson"
  }
}
```

Webhook protected with basic authentication:

```json
{
  "id": "webhook-basic-auth",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "secure-webhook",
    "authentication": "basicAuth",
    "basicAuthUser": "admin",
    "basicAuthPassword": "secretpassword",
    "responseMode": "onReceived",
    "botDetection": true,
    "responseCode": 200,
    "responseData": "noData"
  }
}
```

Webhook protected with header authentication:

```json
{
  "id": "webhook-header-auth",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "PUT",
    "path": "api/webhook",
    "authentication": "headerAuth",
    "headerAuthName": "X-API-Key",
    "headerAuthValue": "your-api-key-here",
    "responseMode": "onReceived",
    "botDetection": false,
    "responseCode": 201,
    "responseData": "firstEntryJson"
  }
}
```

GET webhook on an auto-generated path:

```json
{
  "id": "webhook-get",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "GET",
    "path": "",
    "authentication": "none",
    "responseMode": "onReceived",
    "botDetection": false,
    "responseCode": 200,
    "responseData": "noData"
  }
}
```

Webhook accepting any HTTP method:

```json
{
  "id": "webhook-any-method",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "*",
    "path": "flexible-endpoint",
    "authentication": "none",
    "responseMode": "onReceived",
    "botDetection": true,
    "responseCode": 200,
    "responseData": "firstEntryJson"
  }
}
```

Use this pattern for secure API endpoints that require authentication:

```json
{
  "id": "api-webhook",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "api/v1/webhook",
    "authentication": "headerAuth",
    "headerAuthName": "Authorization",
    "headerAuthValue": "Bearer your-token-here",
    "responseMode": "onReceived",
    "botDetection": true,
    "responseCode": 200,
    "responseData": "firstEntryJson"
  }
}
```

Use this pattern for handling form submissions:

```json
{
  "id": "form-handler",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "form-submit",
    "authentication": "none",
    "responseMode": "onReceived",
    "botDetection": true,
    "responseCode": 200,
    "responseData": "noData"
  }
}
```

Use this pattern for internal system integrations:

```json
{
  "id": "internal-webhook",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "internal/webhook",
    "authentication": "basicAuth",
    "basicAuthUser": "system",
    "basicAuthPassword": "internal-password",
    "responseMode": "onReceived",
    "botDetection": false,
    "responseCode": 202,
    "responseData": "noData"
  }
}
```

### Trigger Behavior

- **Activation:** When the workflow is activated, the node's webhook URL starts accepting requests.
- **Deactivation:** The URL stops accepting requests when the workflow is deactivated.
- **Payload:** The incoming request body, headers and query parameters are output as workflow items.
- **Response:** The node replies to the caller according to its response settings.

## Tips

Entry point that fires when an HTTP request hits the webhook URL. Outputs the request body, headers, query params, and method for downstream processing.

### Important Notes

1. **Authentication Conditional Logic**: When using authentication, ensure you include the appropriate authentication parameters (`basicAuthUser`/`basicAuthPassword` for basic auth, or `headerAuthName`/`headerAuthValue` for header auth).

2. **Response Configuration**: The `responseCode` and `responseData` parameters are only available when `responseMode` is set to `"onReceived"`.

3. **Path Handling**: Leave `path` empty (`""`) to use an auto-generated webhook path, or specify a custom path suffix.

4. **Bot Detection**: Enable `botDetection` to automatically block requests from known bots and crawlers based on User-Agent headers.