Webhooks

A webhook trigger lets any external system — a form tool, your backend, Zapier — start a MOST workflow by POSTing to a URL. Create a workflow, set its trigger type to Webhook, and MOST gives you a dedicated URL.

POST https://most.money/api/webhooks/workflow/<workflowId>

Sending a payload

Send any JSON body. Include contact_id or email to associate the run with a contact; the whole payload is available to the workflow’s steps.

curl https://most.money/api/webhooks/workflow/wf_123 \
  -H "Content-Type: application/json" \
  -d '{ "email": "sam@acme.com", "plan": "pro", "source": "signup-form" }'

The call returns immediately and the workflow runs asynchronously:

{ "ok": true, "runId": "run_9f3c…" }

Securing it (optional HMAC)

Set a secret on the webhook trigger and MOST will require a signature. Compute an HMAC-SHA256 of the raw request body with your secret and send it as a header:

x-webhook-signature: <hex HMAC-SHA256(body, secret)>

Requests with a missing or wrong signature are rejected. Without a secret configured, the endpoint accepts unsigned requests — fine for low-risk internal triggers, but set a secret for anything public.

Requirements

• The workflow must be active and have trigger type webhook.
• Use the builder’s test mode to capture a sample payload before going live.