Venafi TLS Protect Cloud trigger

Overview

Receives webhook notifications from Venafi TLS Protect Cloud when certificate lifecycle and activity events occur. Venafi sends connector-based webhook POSTs containing an events array with message and eventName fields. The trigger supports filtering by activity type (resource) and specific sub-activity (trigger on), allowing fine-grained control over which certificate management events start a workflow. Handles Venafi connection test messages automatically. Useful for automating certificate renewal workflows, compliance alerting, certificate discovery notifications, and TLS infrastructure monitoring.

Node Type

Trigger — webhook (receives incoming HTTP callbacks)

Input / Output

Direction	Port(s)
Input	None (trigger node)
Output	Output

Credentials

This tool requires Venafi TLS Protect Cloud credentials. See the Credentials Guide for setup instructions.

Parameters

Parameter	Type	Required	Default	Description
Resource (Activity Type)	string	Yes	—	The Venafi activity type key to subscribe to. This corresponds to an activity type from the Venafi /v1/activitytypes API endpoint. Examples: “certificateStatusNew”, “certificateStatusUpdate”, “certificateDiscovery”, “certificateProvisioning”. Enter the exact activity type key.
Trigger On (Activity Sub-Types)	string	Yes	*	Comma-separated list of activity sub-type keys to listen for, or ”*” to trigger on all sub-activities under the selected resource. Sub-types are specific event names within the activity type (e.g., “certificateExpiring”, “certificateRenewed”). Find available sub-types via the Venafi /v1/activitytypes API under the selected activity type’s “values” array.

Output Data

A Venafi delivery carries an events array, and the trigger emits one output item per matching event — a single POST can therefore start the workflow with several items.

Each item contains:

• eventName — the Venafi event name, e.g. certificateExpiring
• message — the human-readable activity message Venafi sent
• _trigger — always venafi_tls_protect_cloud_webhook
• _timestamp — ISO 8601 timestamp of when the delivery was received
• _webhookEvent — the same value as eventName, or unknown when Venafi omitted it

All remaining fields of the individual event object are merged onto the item.

Events whose eventName is outside your Trigger On list are dropped; when nothing matches, the delivery is acknowledged without starting the workflow. Venafi’s TESTING CONNECTION... probe, sent when a connector is created, is acknowledged the same way. A POST without a non-empty events array is rejected.

Reference the payload downstream by expression, e.g. {{ $json.eventName }}.

Example Configuration

Every sub-activity under an activity type:

{
  "type": "venafi_tls_protect_cloud_trigger",
  "parameters": {
    "resource": "certificateStatusNew",
    "triggerOn": "*"
  }
}

Only selected sub-activities:

{
  "type": "venafi_tls_protect_cloud_trigger",
  "parameters": {
    "resource": "certificateStatusUpdate",
    "triggerOn": "certificateExpiring,certificateRenewed"
  }
}

Certificate discovery events:

{
  "type": "venafi_tls_protect_cloud_trigger",
  "parameters": {
    "resource": "certificateDiscovery",
    "triggerOn": "*"
  }
}

Trigger Behavior

• Activation: When the workflow is activated, a webhook endpoint is registered with the service.
• Deactivation: The webhook is automatically unregistered when the workflow is deactivated.
• Payload: The incoming webhook payload is parsed and output as workflow items.
• Verification: Supports signature verification where applicable.

Tips

Entry point that fires when Venafi TLS Protect Cloud sends a webhook for subscribed activity events. Configure the activity type (resource) to select the category of events, then choose specific sub-activities to listen for, or select [All] to receive all events of that type. Venafi uses connectors to deliver webhook payloads containing an events array with message and eventName fields.