A WordPress incoming webhook lets an external service start a workflow by sending an HTTP POST request to a URL generated by AI Agent Workflows. Link it to a workflow, optionally require a signing secret, and restrict callers by IP address.
Screenshot to add: Agent Workflows → Webhooks → Add New Webhook form showing Workflow, Signing secret, and IP allow-list
Create an incoming webhook
- Open Agent Workflows → Webhooks.
- Select Add New.
- Choose the workflow in the Workflow field. Only an active linked workflow can run when the endpoint is called.
- Optionally configure a Signing secret. When set, callers must send a valid HMAC signature. If site settings require signing, every webhook must have a signing secret.
- Optionally enter an IP allow-list, with one IPv4 or IPv6 address or IPv4 CIDR range per line. Leave it empty only if requests from any IP are acceptable for your use case.
- Select Create Webhook. Open the saved webhook to copy its generated Public URL (POST).
Send a request
Send an HTTP POST request to the exact Public URL (POST) shown for your webhook. The REST route uses the dragaiw/v1/webhooks/{public_id} path. Do not guess the site domain or public ID; copy the generated URL from the saved webhook.
Send JSON when possible. The workflow payload includes source (webhook), client_ip, and body. If the request body is valid JSON, body contains the decoded data. If it is not valid JSON, the raw request body is placed in body.raw.
Sign requests when a secret is configured
When a signing secret is set, calculate an HMAC-SHA256 signature over the exact raw request body and send it in the X-dragaiw-Signature header using the format sha256=<hex-digest>. The digest must be calculated with the configured secret and the same body bytes that are sent. A missing or invalid signature is rejected.
Security and troubleshooting
- Keep the public URL private when appropriate, and configure a signing secret and IP allow-list for endpoints that receive sensitive or consequential requests.
- The endpoint is rate-limited to 60 requests per minute per client IP and webhook ID.
- Requests from IP addresses outside the configured allow-list are rejected.
- A webhook linked to a draft or paused workflow cannot start that workflow.
- Test with a non-sensitive payload first, then review the workflow run and error response. This documentation does not imply that a live webhook request has been sent.