Ingest anything with the Webhook broker
Install the generic Webhook broker, POST JSON to your per-install URL with a bearer secret — from curl, Zapier, or Make — then map events to records.
The Webhook broker is the generic inbound connector: any HTTP client that can POST JSON — a curl one-liner, Zapier, Make, a CI job, a bespoke script — can push events into BitsWeave. Each install gets its own URL and a bearer secret; payloads land as broker messages, show up on the context graph, and can be routed or mapped to records like any other broker's events.
Org admins
Installing a broker needs the admin role (broker:write). One install
per broker per org.
Install
Start the install
Open /app/brokers/webhook
and start the install — or over MCP, brokers_installations_startInstall with
{ "definitionId": "webhook" }. The install form has two optional fields:
- Display name — a human-readable label for this installation.
- Bearer secret — bring your own (at least 16 characters), or leave blank and a fresh 256-bit secret is generated for you.
Copy the secret — it's shown exactly once
Completing the install returns two things:
- The webhook URL — shaped
https://bitsweave.com/api/webhooks/<install-id>. Each install gets its own; you can re-read it later on the broker detail page. - The bearer secret — shown once, then stored encrypted server-side
and never retrievable again. Copy it into your sender's
Authorizationheader. If you lose it, uninstall and reinstall to mint a new one.
The contract
POST JSON to your install URL, authenticating with the secret as a bearer token:
POST /api/webhooks/<install-id>
Authorization: Bearer <secret>
Content-Type: application/jsonThe event type — the routing key each message is recorded under — resolves in order:
- the
X-Webhook-Eventrequest header, else - an
eventstring field on the JSON body, else - the literal default
event.
Responses:
| Status | Meaning |
|---|---|
200 | Stored — { "ok": true, "brokerMessageId": "…" }. An identical body replayed within an hour adds "deduplicated": true. |
400 | The body isn't valid JSON. |
401 | Missing or wrong bearer secret. |
404 | Unknown install id in the URL. |
413 | Body over the 1 MiB cap. |
There is no payload schema — the broker accepts arbitrary JSON. Raw messages are retained for 7 days; the events they produce live on in the graph.
Recipe: curl
Replace the two placeholders and send:
BITSWEAVE_WEBHOOK_URL='https://bitsweave.com/api/webhooks/YOUR-INSTALL-ID'
BITSWEAVE_WEBHOOK_SECRET='YOUR-BEARER-SECRET'
curl -X POST "$BITSWEAVE_WEBHOOK_URL" \
-H "Authorization: Bearer $BITSWEAVE_WEBHOOK_SECRET" \
-H 'Content-Type: application/json' \
-H 'X-Webhook-Event: deploy.finished' \
-d '{"service": "storefront", "version": "1.42.0", "status": "success"}'A 200 with {"ok":true,"brokerMessageId":"…"} means the event is stored and
visible under the installation's messages.
Recipe: Zapier
Use the Webhooks by Zapier action with the Custom Request event:
- Method —
POST. - URL — your install URL
(
https://bitsweave.com/api/webhooks/YOUR-INSTALL-ID). - Data — the JSON body, mapping in fields from earlier Zap steps, e.g.
{"event": "lead.created", "email": "{{email}}", "plan": "{{plan}}"}. - Headers — add three rows:
Authorization→Bearer YOUR-BEARER-SECRETContent-Type→application/jsonX-Webhook-Event→lead.created(or rely on theeventbody field)
The simpler POST event works too: set Payload Type to json, put your
fields under Data, and add the same Authorization and X-Webhook-Event
headers.
Recipe: Make
Use the HTTP app's Make a request module:
- URL — your install URL.
- Method —
POST. - Headers —
Authorization: Bearer YOUR-BEARER-SECRETand optionallyX-Webhook-Event: order.updated. - Body type —
Raw; Content type —JSON (application/json). - Request content — the JSON payload, mapping in fields from earlier
modules, e.g.
{"event": "order.updated", "orderId": "{{orderId}}"}.
Map events to records
Once events flow in, you can project them into
custom records instead of
leaving them as raw messages. With
schema inference enabled, BitsWeave observes a message schema per
(broker, event type) — every JSON path it has seen. A broker→record
mapper wires that message schema to a record schema, one field line per
sourcePath → targetFieldKey:
- In the UI, a record schema's detail page (
/app/records/<schema-key>) lists its mappers; edit one at/app/records/mappers/<mapper-id>— toggle it and manage its field lines. - Over MCP, use
brokers_recordMappings_create/_update/_list(they needrecord:write/record:read).
Creating an enabled mapper backfills history: existing messages for that event type are projected into records without waiting for the next webhook. From there, routing rules can also send the same events to an agent's inbox.