---
{
  "id": "platform.trigger.events-and-scopes",
  "topic": "trigger",
  "title": "Trigger events, scopes, and Webhook relationship",
  "locale": "en",
  "version": "2026-08-31",
  "summary": "Trigger source, event, and scope values are bounded by the action registry; Webhook accepts the external request before Trigger can observe webhook.received.",
  "content": "The public action registry currently exposes only `kanban`, `notebook`, and `webhook` source types. Do not advertise the service’s internal calendar, form, or mind-map support until those values appear in `ActionDefinition.input_schema`.\n\nPublic event values are `card.created`, `card.updated`, `card.deleted`, `card.moved`, `card.moved_into_column`, `card.moved_out_of_column`, `column.cleared`, `board.all_done`, `note.created`, `note.updated`, `note.deleted`, `webhook.received`, and `*`. Wildcard means any supported event for that configured source; it does not turn Trigger into an arbitrary event bus.\n\nUser-created REST and web Notebook triggers additionally support `note.archived` and `note.unarchived`. Those service events intentionally remain outside the Agent action registry in v1; use the web Trigger form for archive lifecycle automation.\n\nA Kanban scope requires `boardId` and may narrow by either `cardId` or `columnId`, never both. A Notebook scope requires `notebookId` and may add `noteId`. A Webhook scope requires one UUID `webhookId`. Creating or updating that Webhook-backed Trigger also requires this Agent's explicit `read` or `write` grant on the Webhook; denial is returned as not found. Unknown keys fail closed. Use IDs the owner can access; runtime validation remains authoritative.\n\nWebhook owns the inbound endpoint, HMAC/replay validation, secret rotation, and payload retention. Only after a request is accepted can Trigger observe `webhook.received`. For an endpoint plus downstream Agent task, select Webhook + Trigger; an unauthenticated or rejected inbound request must not be described as a successful Trigger fire.\n",
  "aliases": [
    "sourceType",
    "sourceScope",
    "eventType",
    "card moved event",
    "notebook event",
    "webhook received",
    "wildcard event"
  ],
  "tags": [
    "trigger",
    "event",
    "scope",
    "webhook"
  ],
  "relatedActions": [
    "arinova.trigger.create_trigger",
    "arinova.trigger.update_trigger",
    "arinova.webhook.create_webhook"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/trigger/events-and-scopes/"
}
---

The public action registry currently exposes only `kanban`, `notebook`, and `webhook` source types. Do not advertise the service’s internal calendar, form, or mind-map support until those values appear in `ActionDefinition.input_schema`.

Public event values are `card.created`, `card.updated`, `card.deleted`, `card.moved`, `card.moved_into_column`, `card.moved_out_of_column`, `column.cleared`, `board.all_done`, `note.created`, `note.updated`, `note.deleted`, `webhook.received`, and `*`. Wildcard means any supported event for that configured source; it does not turn Trigger into an arbitrary event bus.

User-created REST and web Notebook triggers additionally support `note.archived` and `note.unarchived`. Those service events intentionally remain outside the Agent action registry in v1; use the web Trigger form for archive lifecycle automation.

A Kanban scope requires `boardId` and may narrow by either `cardId` or `columnId`, never both. A Notebook scope requires `notebookId` and may add `noteId`. A Webhook scope requires one UUID `webhookId`. Creating or updating that Webhook-backed Trigger also requires this Agent's explicit `read` or `write` grant on the Webhook; denial is returned as not found. Unknown keys fail closed. Use IDs the owner can access; runtime validation remains authoritative.

Webhook owns the inbound endpoint, HMAC/replay validation, secret rotation, and payload retention. Only after a request is accepted can Trigger observe `webhook.received`. For an endpoint plus downstream Agent task, select Webhook + Trigger; an unauthenticated or rejected inbound request must not be described as a successful Trigger fire.