Webhook node

Overview

Starts a workflow when an external HTTP request hits the webhook URL. Supports GET, POST, PUT, PATCH, DELETE methods with configurable authentication and response modes.

Node Type

Trigger — webhook (receives incoming HTTP callbacks)

Input / Output

Direction	Port(s)
Input	None (trigger node)
Output	Output

Credentials

This tool does not require any credentials.

Parameters

Parameter	Type	Required	Default	Description
HTTP Method	options	No	POST	The HTTP method to listen for.
				Options: GET, POST, PUT, PATCH, DELETE, * (All — accepts any method)
Path	string	No	—	Custom webhook path suffix. Leave empty for auto-generated path.
Authentication	options	No	none	Authentication method for incoming requests.
				Options: none, basicAuth, headerAuth
Username	string	No	—	Username for Basic Auth. (shown when Authentication is basicAuth)
Password	string	No	—	Password for Basic Auth. (shown when Authentication is basicAuth)
Header Name	string	No	x-webhook-token	Name of the header to check. (shown when Authentication is headerAuth)
Header Value	string	No	—	Expected value of the auth header. (shown when Authentication is headerAuth)
Response Mode	options	No	onReceived	When to send the HTTP response.
				Options: onReceived (Immediately — reply as soon as the request is accepted)
Response Code	number	No	200	HTTP status code for the response. (shown when Response Mode is onReceived)
Response Data	options	No	firstEntryJson	What data to include in the response.
				Options: firstEntryJson (First Entry JSON — returns the first data entry as JSON), noData (No Response Body — returns an empty response body)
Bot Detection	boolean	No	false	Block requests from known bots and crawlers (uses User-Agent detection).

Output Data

Each incoming request produces one output item describing that request:

• headers — the request headers
• params — the route parameters
• query — the query-string parameters
• body — the parsed request body
• method — the HTTP method the caller used
• url — the requested URL
• _trigger — always webhook
• _timestamp — ISO 8601 timestamp of when the request arrived

Reference the payload downstream by expression, e.g. {{ $json.body.orderId }}.

Example Configuration

Basic webhook with no authentication:

{
  "id": "webhook-node",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "my-webhook",
    "authentication": "none",
    "responseMode": "onReceived",
    "botDetection": false,
    "responseCode": 200,
    "responseData": "firstEntryJson"
  }
}

Webhook protected with basic authentication:

{
  "id": "webhook-basic-auth",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "secure-webhook",
    "authentication": "basicAuth",
    "basicAuthUser": "admin",
    "basicAuthPassword": "secretpassword",
    "responseMode": "onReceived",
    "botDetection": true,
    "responseCode": 200,
    "responseData": "noData"
  }
}

Webhook protected with header authentication:

{
  "id": "webhook-header-auth",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "PUT",
    "path": "api/webhook",
    "authentication": "headerAuth",
    "headerAuthName": "X-API-Key",
    "headerAuthValue": "your-api-key-here",
    "responseMode": "onReceived",
    "botDetection": false,
    "responseCode": 201,
    "responseData": "firstEntryJson"
  }
}

GET webhook on an auto-generated path:

{
  "id": "webhook-get",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "GET",
    "path": "",
    "authentication": "none",
    "responseMode": "onReceived",
    "botDetection": false,
    "responseCode": 200,
    "responseData": "noData"
  }
}

Webhook accepting any HTTP method:

{
  "id": "webhook-any-method",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "*",
    "path": "flexible-endpoint",
    "authentication": "none",
    "responseMode": "onReceived",
    "botDetection": true,
    "responseCode": 200,
    "responseData": "firstEntryJson"
  }
}

Use this pattern for secure API endpoints that require authentication:

{
  "id": "api-webhook",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "api/v1/webhook",
    "authentication": "headerAuth",
    "headerAuthName": "Authorization",
    "headerAuthValue": "Bearer your-token-here",
    "responseMode": "onReceived",
    "botDetection": true,
    "responseCode": 200,
    "responseData": "firstEntryJson"
  }
}

Use this pattern for handling form submissions:

{
  "id": "form-handler",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "form-submit",
    "authentication": "none",
    "responseMode": "onReceived",
    "botDetection": true,
    "responseCode": 200,
    "responseData": "noData"
  }
}

Use this pattern for internal system integrations:

{
  "id": "internal-webhook",
  "type": "core_webhook",
  "position": [0, 0],
  "parameters": {
    "httpMethod": "POST",
    "path": "internal/webhook",
    "authentication": "basicAuth",
    "basicAuthUser": "system",
    "basicAuthPassword": "internal-password",
    "responseMode": "onReceived",
    "botDetection": false,
    "responseCode": 202,
    "responseData": "noData"
  }
}

Trigger Behavior

• Activation: When the workflow is activated, the node’s webhook URL starts accepting requests.
• Deactivation: The URL stops accepting requests when the workflow is deactivated.
• Payload: The incoming request body, headers and query parameters are output as workflow items.
• Response: The node replies to the caller according to its response settings.

Tips

This tool receives incoming HTTP requests, acting as an API endpoint for external services. It is ideal when a workflow needs to be initiated by an external system sending data or a signal via an HTTP call. It produces the full details of the incoming request, including its body, headers, query parameters, and method.

Important Notes

1. Authentication Conditional Logic: When using authentication, ensure you include the appropriate authentication parameters (basicAuthUser/basicAuthPassword for basic auth, or headerAuthName/headerAuthValue for header auth).

2. Response Configuration: The responseCode and responseData parameters are only available when responseMode is set to "onReceived".

3. Path Handling: Leave path empty ("") to use an auto-generated webhook path, or specify a custom path suffix.

4. Bot Detection: Enable botDetection to automatically block requests from known bots and crawlers based on User-Agent headers.