> For the complete documentation index, see [llms.txt](https://docs.rootcause.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rootcause.ai/more-details/applications/application-modules/onwebhook.md).

# On webhook

> Start a flow when an external service POSTs to this application's webhook URL.

Starts a flow when an external service POSTs to this application's webhook URL.

`slug` is the path the URL ends in. The shared secret is never stored in the flow — `hashedSecret` and `secretPrefix` are all that is kept, enough to verify a signature and to show an operator which secret is in use without being able to read it back.

## At a glance

|                          |                        |
| ------------------------ | ---------------------- |
| Module type              | `OnWebhook`            |
| Category                 | Events                 |
| Default tier             | `durable`              |
| Runs on                  | `durable`              |
| Starts a flow            | yes                    |
| Holds a body             | no                     |
| Keeps state between runs | no                     |
| Available in             | every application type |

## Parameters

### `slug`

`string` · required · defaults to `""`

The path this application's webhook URL ends in.

### `secretName`

`string | null` · optional · defaults to `null`

What the shared secret is called, for an operator rotating it.

### `hashedSecret`

`string | null` · optional · defaults to `null`

The secret's hash — enough to verify a signature, never enough to read it back.

### `secretPrefix`

`string | null` · optional · defaults to `null`

The first characters of the secret, so an operator can tell which one is in use.

### `rotatedAt`

`string | null` · optional · defaults to `null`

When the secret was last rotated.

## Inputs

*None.*

## Outputs

| Port      | Kind    | Connects to                | Description                                                        |
| --------- | ------- | -------------------------- | ------------------------------------------------------------------ |
| `event`   | `event` | `event`, `json`            | The event envelope: `{kind, at, payload}`.                         |
| `payload` | `json`  | `json`, `scalar`, `signal` | The POSTed body, parsed.                                           |
| `headers` | `json`  | `json`, `scalar`, `signal` | The request headers, for a service that signs or routes with them. |

***

[← All application modules](/more-details/applications/application-modules.md)