Webhooks

A webhook is a content resource, prefixed WHK_, that sends an outbound HTTP request when a platform event fires, with its URL, headers, and body rendered from LiquidJS templates against the event payload.

Each webhook binds to one event name (CaseCreated, ThreatReportCreated, and the rest listed below), and sends the request with the configured HTTP method. A {{ credential.<name> }} reference in any template resolves against a stored credential, so secrets never sit in the template text. Webhooks route cases, threat reports, and usage alerts to external systems such as Slack, Jira, and PagerDuty.

Trigger events

eventName takes one of the following values. Each event delivers a payload whose top-level key names the object below, plus a type field equal to the event name. Templates read the payload directly, so a ThreatReportCreated body references {{ threatReport.name }}.

Event	Payload key	Fires when
CaseCreated	case	A case is opened.
CaseClosed	case	A case is closed.
CaseInitialAnalysisCompleted	case	The agent finishes initial analysis on a case.
ContentWorkItemCreated	contentWorkItem	A content work item is created.
ThreatReportCreated	threatReport	A threat report is created.
CircuitBreakerTripped	circuitBreaker	A platform circuit breaker trips.
SimbaUsageAlert	alert	Agent usage crosses a configured quota threshold.

Templating

The url, headers values, and body are LiquidJS templates. Two kinds of reference resolve at send time.

Reference	Resolves to
{{ <field> }}	A field of the event payload, e.g. {{ case.name }} or {{ type }}. Any Liquid filter applies, so {{ case.summary | json }} escapes a value for a JSON body.
{{ credential.<name> }}	A stored credential by name. Use bracket notation ({{ credential["my-key"] }}) when the name is not a valid identifier. Text and OAuth2 credentials substitute their value string. For an AwsRole or HmacSignature credential, Perpetual computes a signed request header over the final request.

Inputs

Field	Type	Required	Description
name	string	Required	Webhook name.
eventName	enum	Required	The platform event that fires this webhook. See Trigger events for the values and their payloads.
url	string	Required	The request URL, a Liquid template. Renders against the event payload and any credential.* references.
method	enum	Required	HTTP method for the request: GET, POST, PUT, PATCH, DELETE.
headers	object	Required	Request headers as a string-to-string map. Each value is a Liquid template. An empty object sends no headers.
body	string	Optional	The request body, a Liquid template. Absent sends no body.
folderPath	string	Optional	Folder location within the Space, e.g. Webhooks/Slack.

Outputs

A webhook returns no fields of its own.

Plus the common resource fields.

Related

• Credentials, the secrets a credential.* reference injects.
• Cases, the resource behind the CaseCreated, CaseClosed, and CaseInitialAnalysisCompleted events.
• Changesets, how webhook edits are staged and committed.
• Route signals to Slack, Jira, or PagerDuty, how to author, preview, and validate a webhook.