Make a webhook trigger's signing secret
A new Standard Webhooks secret (whsec_…) for a webhook trigger, shown this once; the one before stops working at once. Give it to the sender with the trigger's webhookUrl.
AuthorizationBearer <token>An application key of the Tenant (PUT /v1/tenant/keys/{keyId}), or Studio's key, derived from the admin key. With Nylorun-Subject and Nylorun-Scopes, it acts for that person, narrowed to those scopes. Never accepted from a browser (Origin).
agentId*stringThe Agent id, percent-encoded
triggerId*stringThe trigger's id in the manifest's runtime.triggers
Nylorun-Protocol*stringThe protocol version, 18
Nylorun-Subject?stringThe person an application key acts for
Nylorun-Scopes?stringThe subject's space-separated scopes; required with a subject
The secret, this once
application/json- response
triggerId*stringwebhookUrl*stringsecret*stringimport { createClient } from "@nylorun/agents";const client = await createClient();const { webhookUrl, secret } = await client.agents.rotateWebhookSecret( "users/alice/assistant", "github",); // the secret is shown once{ "triggerId": "string", "webhookUrl": "string", "secret": "string"}List an Agent's runs GET
Each time one of its triggers fired or was run by hand, newest first: when it was due, whether it was late, and what came of it (`started`, `queued`, `skipped` or `failed`, with a reason), with the session and turn.
Deliver to a webhook trigger POST
A sender's delivery, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp` within 5 minutes by default, `webhook-signature`): no credential (an `Authorization` header is ignored) and no `Nylorun-Protocol`. The body, any media type, at most the Runtime limit `webhookBodyBytes`, is read as bytes and verified before anything else. It runs the trigger once per `webhook-id`: a retry answers the first run. The body reaches the model as data under the trigger's prompt. Other senders (GitHub, Stripe, Slack) are relayed by an app.