Webhooks

A webhook routine runs each time something POSTs to its URL with its key. Create one with New routine → Webhook; its page then shows everything you need to call it.

The key is shown once

Felix shows the key once: right after you create the routine, or when you press Create key or Regenerate key. Copy it then: Felix keeps only a fingerprint and can never show it again.

The box gives the key, the Authorization header, the URL with the key at its end, and a ready-to-copy curl example. Press I’ve saved the key (or leave the page) and it is gone; the page then shows the same lines with <your key>. Regenerate key makes the old key stop working at once.

A webhook routine that an agent created for you has no key until you create one: agents never see webhook keys.

Calling it

Two forms; use the one your sender supports.

• Key in a header (preferred): POST https://<felix>/hooks/r/<routine id> with Authorization: Bearer <key>.
• Key in the path, for senders that only take a URL: POST https://<felix>/hooks/r/<routine id>/<key>.

curl -X POST https://app.chaifax.fr/hooks/r/<routine id> \
  -H "Authorization: Bearer <key>" -H "Content-Type: application/json" \
  -d '{"order": 42}'

• Zapier, Make, n8n: a “Webhooks / HTTP request” step, method POST, the first URL, and a header Authorization = Bearer <key>.
• GitHub (repository Settings → Webhooks → Add webhook): payload URL with the key in the path, content type application/json, secret left empty. GitHub’s event name (issues, push…) is passed to the agent.
• Composio triggers: point the trigger’s webhook URL at the key-in-path URL.

Keys in URLs leak

A key in a URL ends up in the sender’s logs and settings pages. Prefer the header when the sender allows it, and regenerate the key if a URL leaked. Felix does not check sender signatures: the key is the only proof.

The body

The body (up to 64 KiB, any text content type, empty allowed) becomes the run’s input, exactly as sent. The agent reads it fenced as data from an outside service, never as instructions. It is cut at 16,000 characters in the message.

Answers

Answer	Meaning
202 {"run":"queued"}	Accepted: the run started or waits for the agent.
401 unauthorized	Wrong or missing key, or no key created yet.
404 not_found	Unknown or deleted routine.
409 paused	The routine is paused (or the account is suspended).
413 too_large	Body over 64 KiB.
415 unsupported_body	The body is not UTF-8 text.
429 rate_limited	More than 60 calls in the routine’s current hour; see Retry-After.
429 queue_full	10 calls already wait for the agent; retry after 60 seconds.

Other methods than POST get 405.