---
{
  "id": "platform.webhook.create-and-targets",
  "topic": "webhook",
  "title": "Create a webhook and configure its target",
  "locale": "en",
  "version": "2026-08-09",
  "summary": "Creation supports four target types with strict targetConfig shapes, optional expiry, and a display-once signing secret.",
  "content": "`arinova.webhook.create_webhook` requires `name`. `targetType` defaults to `none`, `enabled` to true, and optional ISO-8601 `expiresAt` gates inbound requests.\n\nThe accepted target shapes are strict:\n\n- `none`: `targetConfig` must be `{}`.\n- `post_to_conversation`: requires `conversationId` and `messageTemplate`; `senderType` may only be `system`.\n- `create_card`: requires `boardId` and `titleTemplate`; optional `columnId`, `descriptionTemplate`, and label UUIDs.\n- `run_workflow`: requires only `workflowId`. The workflow must belong to the webhook owner and be active when the event dispatches.\n\nFor `run_workflow`, accepted JSON becomes workflow `trigger_payload` unchanged; top-level fields use `{{trigger.payload.field}}`. Its separate 102,400-byte payload cap is smaller than the 1 MiB inbound limit; excess becomes `render_error`. Success means run creation, not completion. Once that Workflow creates its default ten runs in the rolling hour, counting every status, the function is `skipped` as `workflow_rate_limited`.\n\nA missing target rejects create/update. An existing target without owner access saves with `targetPermissionWarning` but fails until fixed. Dispatch rechecks captured target configuration.\n\nEach owner may have 100 non-cancelled Webhooks. Create returns plaintext `signingSecret` once; store it immediately. Idempotency replay omits it, and list/get never reveal it. Update handles metadata, target, enabled, expiry, or `status: active`; rotation is separately confirmed.\n",
  "aliases": [
    "create webhook",
    "targetType",
    "targetConfig",
    "post to conversation",
    "create card",
    "run workflow",
    "destination"
  ],
  "tags": [
    "configuration",
    "display-once",
    "targets"
  ],
  "relatedActions": [
    "arinova.webhook.create_webhook",
    "arinova.webhook.update_webhook",
    "arinova.webhook.get_webhook"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/webhook/create-and-targets/"
}
---

`arinova.webhook.create_webhook` requires `name`. `targetType` defaults to `none`, `enabled` to true, and optional ISO-8601 `expiresAt` gates inbound requests.

The accepted target shapes are strict:

- `none`: `targetConfig` must be `{}`.
- `post_to_conversation`: requires `conversationId` and `messageTemplate`; `senderType` may only be `system`.
- `create_card`: requires `boardId` and `titleTemplate`; optional `columnId`, `descriptionTemplate`, and label UUIDs.
- `run_workflow`: requires only `workflowId`. The workflow must belong to the webhook owner and be active when the event dispatches.

For `run_workflow`, accepted JSON becomes workflow `trigger_payload` unchanged; top-level fields use `{{trigger.payload.field}}`. Its separate 102,400-byte payload cap is smaller than the 1 MiB inbound limit; excess becomes `render_error`. Success means run creation, not completion. Once that Workflow creates its default ten runs in the rolling hour, counting every status, the function is `skipped` as `workflow_rate_limited`.

A missing target rejects create/update. An existing target without owner access saves with `targetPermissionWarning` but fails until fixed. Dispatch rechecks captured target configuration.

Each owner may have 100 non-cancelled Webhooks. Create returns plaintext `signingSecret` once; store it immediately. Idempotency replay omits it, and list/get never reveal it. Update handles metadata, target, enabled, expiry, or `status: active`; rotation is separately confirmed.