Platform · Integration
Webhooks: how events get into VegaDūta
VegaDūta uses webhooks in two ways. First, any workflow can expose an inbound trigger webhook — an authenticated URL your own systems call to start a run, with configurable auth modes and hashed tokens. Second, every connected channel — WhatsApp, Telegram, Slack, billing events — reaches the platform over validated webhooks with signature checks, so spoofed events are rejected before they touch a workflow.
One honest limitation up front: general outbound webhook subscriptions — the platform POSTing event notifications to your endpoint with retries — are not built yet. The developer API and MCP server are today's pull-side integration surface.
Inbound trigger webhooks
Give a workflow a webhook trigger and it gets a callable URL. Auth is configurable per trigger, and tokens are stored hashed rather than in plaintext, so a database read never yields a usable secret. This is the standard way to start VegaDūta runs from a CRM, a cron job, or any system that can send an HTTP request.
Signature checks on every channel
The webhooks you never see matter just as much. Incoming events from WhatsApp, Telegram, Slack, and the billing gateway all pass signature validation before they are processed. An event that fails its check is dropped — a forged "payment succeeded" or fake customer message never reaches your agents.
What is not built yet: outbound subscriptions
You cannot currently register your own endpoint to receive platform events with delivery retries; outbound webhooks today are limited to platform alerting. If your integration needs to observe VegaDūta, poll the developer API or connect over the MCP server — both cover agents, workflows, and knowledge. We list this plainly because knowing it now beats discovering it mid-build.
Frequently asked questions
Can I trigger a VegaDūta workflow from an external system via webhook?
Yes. Add a webhook trigger to the workflow and it exposes an authenticated URL with configurable auth modes; trigger tokens are stored hashed at rest. Any system that can make an HTTP request — a CRM, a script, another platform — can start the run.
Does VegaDūta verify webhook signatures on incoming channel events?
Yes. Events from every connected channel — WhatsApp, Telegram, Slack, and billing among them — are signature-checked before processing, and events that fail validation are rejected. This blocks spoofed messages and forged payment notifications.
Can VegaDūta send outbound webhooks to my endpoint when events happen?
Not yet. General outbound webhook subscriptions with retries are not built; outbound traffic today is platform alerting only. Use the developer API to poll for state, or the MCP server to integrate agents and workflows directly.
How are webhook tokens secured?
Trigger tokens are hashed before storage, so the platform database never holds a usable plaintext secret, and each trigger's auth mode is configured independently. Inbound channel webhooks are additionally protected by per-channel signature validation.
See it working in two minutes
The sandbox provisions a real tenant — describe an agent in one sentence and test it, no account, no card. Or browse ~90 industry workflow recipes to see what teams build.
