Skip to main content

interactor-webhooks

Enables real-time updates from Interactor via webhooks or Server-Sent Events for dynamic UIs and workflow monitoring.

Install this skill

or
0/100

Security score

The interactor-webhooks skill was audited on Feb 12, 2026 and we found 276 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 697

Template literal with variable interpolation in command context

SourceSKILL.md
697console.log(`Received event: ${event.type} (${event.id})`);
medium line 701

Template literal with variable interpolation in command context

SourceSKILL.md
701console.error(`Failed to process event ${event.id}:`, err);
medium line 1135

Template literal with variable interpolation in command context

SourceSKILL.md
1135const idempotencyKey = `webhook:processed:${event.id}`;
medium line 1141

Template literal with variable interpolation in command context

SourceSKILL.md
1141console.log(`Event ${event.id} already processed, skipping`);
medium line 1147

Template literal with variable interpolation in command context

SourceSKILL.md
1147console.log(`Successfully processed event ${event.id}`);
medium line 1173

Template literal with variable interpolation in command context

SourceSKILL.md
1173const attemptKey = `webhook:attempts:${event.id}`;
medium line 1190

Template literal with variable interpolation in command context

SourceSKILL.md
1190console.error(`Event ${event.id} moved to DLQ after ${attempts} attempts`);
medium line 1193

Template literal with variable interpolation in command context

SourceSKILL.md
1193await alertOps(`Webhook event ${event.id} failed ${attempts} times`);
medium line 1195

Template literal with variable interpolation in command context

SourceSKILL.md
1195console.warn(`Event ${event.id} failed (attempt ${attempts}/${MAX_PROCESS_ATTEMPTS})`);
medium line 1208

Template literal with variable interpolation in command context

SourceSKILL.md
1208console.log(`DLQ item: ${event.id} failed at ${failedAt}: ${error}`);
medium line 1378

Template literal with variable interpolation in command context

SourceSKILL.md
1378headers: { 'Authorization': `Bearer ${authToken}` },
medium line 1382

Template literal with variable interpolation in command context

SourceSKILL.md
1382return new EventSource(`/api/sse/rooms/${roomId}?token=${token}`);
medium line 1399

Template literal with variable interpolation in command context

SourceSKILL.md
1399`https://core.interactor.com/api/v1/agents/rooms/${req.params.roomId}/stream`,
medium line 1400

Template literal with variable interpolation in command context

SourceSKILL.md
1400{ headers: { 'Authorization': `Bearer ${process.env.INTERACTOR_ACCESS_TOKEN}` } }
medium line 1405

Template literal with variable interpolation in command context

SourceSKILL.md
1405res.write(`event: ${event.type}\ndata: ${event.data}\n\n`);
medium line 1443

Template literal with variable interpolation in command context

SourceSKILL.md
1443console.warn(`SSE connection stale (${timeSinceHeartbeat}ms since last heartbeat)`);
medium line 1477

Template literal with variable interpolation in command context

SourceSKILL.md
1477`https://core.interactor.com/api/v1/agents/rooms/${roomId}/stream?token=${token}`
medium line 1571

Template literal with variable interpolation in command context

SourceSKILL.md
1571const url = `https://core.interactor.com/api/v1/agents/rooms/${roomId}/stream?token=${token}`;
medium line 1676

Template literal with variable interpolation in command context

SourceSKILL.md
1676<div key={msg.id} className={`message ${msg.role}`}>
medium line 1714

Template literal with variable interpolation in command context

SourceSKILL.md
1714const url = `${this.baseUrl}/agents/rooms/${roomId}/stream`;
medium line 1718

Template literal with variable interpolation in command context

SourceSKILL.md
1718'Authorization': `Bearer ${this.token}`
medium line 1793

Template literal with variable interpolation in command context

SourceSKILL.md
1793const url = `${this.baseUrl}/workflows/instances/${instanceId}/stream`;
medium line 1797

Template literal with variable interpolation in command context

SourceSKILL.md
1797'Authorization': `Bearer ${this.token}`
medium line 1949

Template literal with variable interpolation in command context

SourceSKILL.md
1949```typescript
medium line 2187

Template literal with variable interpolation in command context

SourceSKILL.md
2187console.log(`[${event.id}] ${event.type}: ${res.status} ${res.statusText}`);
medium line 2189

Template literal with variable interpolation in command context

SourceSKILL.md
2189console.error(`[${event.id}] FAILED:`, error);
medium line 2280

Template literal with variable interpolation in command context

SourceSKILL.md
2280const response = await fetch(`https://core.interactor.com/api/v1${endpoint}`, options);
medium line 2284

Template literal with variable interpolation in command context

SourceSKILL.md
2284console.warn(`Rate limited. Retrying after ${retryAfter}s`);
medium line 47

Curl to non-GitHub URL

SourceSKILL.md
47curl https://core.interactor.com/api/v1/webhooks/event-types \
medium line 150

Curl to non-GitHub URL

SourceSKILL.md
150curl -X POST https://core.interactor.com/api/v1/tokens \
medium line 164

Curl to non-GitHub URL

SourceSKILL.md
164curl -X POST https://core.interactor.com/api/v1/webhooks \
medium line 203

Curl to non-GitHub URL

SourceSKILL.md
203curl https://core.interactor.com/api/v1/webhooks \
medium line 229

Curl to non-GitHub URL

SourceSKILL.md
229curl https://core.interactor.com/api/v1/webhooks/wh_abc \
medium line 236

Curl to non-GitHub URL

SourceSKILL.md
236curl -X PUT https://core.interactor.com/api/v1/webhooks/wh_abc \
medium line 248

Curl to non-GitHub URL

SourceSKILL.md
248curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/toggle \
medium line 255

Curl to non-GitHub URL

SourceSKILL.md
255curl -X DELETE https://core.interactor.com/api/v1/webhooks/wh_abc \
medium line 264

Curl to non-GitHub URL

SourceSKILL.md
264curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/regenerate-secret \
medium line 286

Curl to non-GitHub URL

SourceSKILL.md
286curl https://core.interactor.com/api/v1/webhooks/wh_abc/events \
medium line 321

Curl to non-GitHub URL

SourceSKILL.md
321curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/test \
medium line 1289

Curl to non-GitHub URL

SourceSKILL.md
1289curl -N https://core.interactor.com/api/v1/workflows/instances/inst_xyz/stream \
medium line 1317

Curl to non-GitHub URL

SourceSKILL.md
1317curl -N https://core.interactor.com/api/v1/agents/rooms/room_xyz/stream \
medium line 1970

Curl to non-GitHub URL

SourceSKILL.md
1970// curl -X POST http://localhost:4000/webhooks/interactor \
medium line 1981

Curl to non-GitHub URL

SourceSKILL.md
1981curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/test \
low line 1376

Fetch to external URL

SourceSKILL.md
1376const { token } = await fetch('/api/sse-token', {
medium line 2

Webhook reference - potential data exfiltration

SourceSKILL.md
2name: interactor-webhooks
medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md
3description: Receive real-time updates from Interactor via webhooks (push) or Server-Sent Events (pull). Use when building real-time UIs, monitoring credential changes, tracking workflow progress, or
medium line 7

Webhook reference - potential data exfiltration

SourceSKILL.md
7# Interactor Webhooks and Streaming Skill
medium line 9

Webhook reference - potential data exfiltration

SourceSKILL.md
9Receive real-time updates from Interactor via webhooks (push to your server) or Server-Sent Events (pull from browser/client).
medium line 22

Webhook reference - potential data exfiltration

SourceSKILL.md
22- HTTPS endpoint for webhooks (required for production)
medium line 23

Webhook reference - potential data exfiltration

SourceSKILL.md
23- Understanding of webhook security (signature verification)
medium line 25

Webhook reference - potential data exfiltration

SourceSKILL.md
25## Webhooks vs SSE: When to Use Each
medium line 29

Webhook reference - potential data exfiltration

SourceSKILL.md
29| Backend notifications | **Webhooks** | Server-to-server, reliable delivery |
medium line 30

Webhook reference - potential data exfiltration

SourceSKILL.md
30| Credential status changes | **Webhooks** | Background processing, no UI needed |
medium line 31

Webhook reference - potential data exfiltration

SourceSKILL.md
31| Workflow completion | **Webhooks** | Trigger backend actions |
medium line 36

Webhook reference - potential data exfiltration

SourceSKILL.md
36**General Rule**: Use webhooks for backend-to-backend, SSE for frontend real-time updates.
medium line 40

Webhook reference - potential data exfiltration

SourceSKILL.md
40## Webhooks
medium line 42

Webhook reference - potential data exfiltration

SourceSKILL.md
42Webhooks push events to your server when things happen in Interactor.
low line 47

Webhook reference - potential data exfiltration

SourceSKILL.md
47curl https://core.interactor.com/api/v1/webhooks/event-types \
medium line 75

Webhook reference - potential data exfiltration

SourceSKILL.md
75| Category | Webhook Events | Description |
medium line 85

Webhook reference - potential data exfiltration

SourceSKILL.md
85Interactor follows these principles for webhook payload changes:
medium line 99

Webhook reference - potential data exfiltration

SourceSKILL.md
99- Test against the `/webhooks/:id/test` endpoint after updates
medium line 105

Webhook reference - potential data exfiltration

SourceSKILL.md
105| `credential.created` | User completes OAuth flow | Webhook | Log for audit, update UI state |
medium line 106

Webhook reference - potential data exfiltration

SourceSKILL.md
106| `credential.refreshed` | Token auto-refreshed | Webhook | Log for audit (usually no action needed) |
medium line 107

Webhook reference - potential data exfiltration

SourceSKILL.md
107| `credential.expired` | Refresh token failed | Webhook | **Notify user to reconnect**, disable features |
medium line 108

Webhook reference - potential data exfiltration

SourceSKILL.md
108| `credential.revoked` | User revoked via provider | Webhook | **Notify user to reconnect**, disable features |
medium line 109

Webhook reference - potential data exfiltration

SourceSKILL.md
109| `workflow.instance.created` | Workflow started | Webhook | Track in analytics, show in dashboard |
medium line 110

Webhook reference - potential data exfiltration

SourceSKILL.md
110| `workflow.instance.halted` | Workflow needs user input | Webhook | **Notify user**, show input form |
medium line 111

Webhook reference - potential data exfiltration

SourceSKILL.md
111| `workflow.instance.completed` | Workflow finished successfully | Webhook | **Process results**, update records |
medium line 112

Webhook reference - potential data exfiltration

SourceSKILL.md
112| `workflow.instance.failed` | Workflow error | Webhook | **Alert ops**, log error details |
medium line 113

Webhook reference - potential data exfiltration

SourceSKILL.md
113| `agent.room.message` | AI sent complete message | Webhook | Forward to push notification or websocket |
medium line 114

Webhook reference - potential data exfiltration

SourceSKILL.md
114| `agent.room.closed` | Chat session ended | Webhook | Log analytics, cleanup resources |
medium line 130

Webhook reference - potential data exfiltration

SourceSKILL.md
130Webhook management requires specific permissions in Interactor:
medium line 134

Webhook reference - potential data exfiltration

SourceSKILL.md
134| List webhooks | `webhooks:read` | Admin, Developer |
medium line 135

Webhook reference - potential data exfiltration

SourceSKILL.md
135| Create webhook | `webhooks:write` | Admin, Developer |
medium line 136

Webhook reference - potential data exfiltration

SourceSKILL.md
136| Update webhook | `webhooks:write` | Admin, Developer |
medium line 137

Webhook reference - potential data exfiltration

SourceSKILL.md
137| Delete webhook | `webhooks:delete` | Admin only |
medium line 138

Webhook reference - potential data exfiltration

SourceSKILL.md
138| Regenerate secret | `webhooks:write` | Admin, Developer |
medium line 139

Webhook reference - potential data exfiltration

SourceSKILL.md
139| View delivery history | `webhooks:read` | Admin, Developer |
medium line 143

Webhook reference - potential data exfiltration

SourceSKILL.md
143When creating API tokens for webhook management, request these scopes:
medium line 144

Webhook reference - potential data exfiltration

SourceSKILL.md
144- `webhooks` - Full webhook management (read + write + delete)
medium line 145

Webhook reference - potential data exfiltration

SourceSKILL.md
145- `webhooks:read` - Read-only access to webhook configuration
medium line 146

Webhook reference - potential data exfiltration

SourceSKILL.md
146- `webhooks:write` - Create and update (no delete)
low line 149

Webhook reference - potential data exfiltration

SourceSKILL.md
149# Token with full webhook access
low line 152

Webhook reference - potential data exfiltration

SourceSKILL.md
152-d '{"name": "Webhook Manager", "scopes": ["webhooks"]}'
medium line 155

Webhook reference - potential data exfiltration

SourceSKILL.md
155> **Security Note**: Webhook secrets are only shown once at creation and regeneration. Store them securely in environment variables or a secrets manager.
medium line 161

Webhook reference - potential data exfiltration

SourceSKILL.md
161### Step 1: Create a Webhook
low line 164

Webhook reference - potential data exfiltration

SourceSKILL.md
164curl -X POST https://core.interactor.com/api/v1/webhooks \
low line 168

Webhook reference - potential data exfiltration

SourceSKILL.md
168"url": "https://yourapp.com/webhooks/interactor",
low line 184

Webhook reference - potential data exfiltration

SourceSKILL.md
184"url": "https://yourapp.com/webhooks/interactor",
medium line 198

Webhook reference - potential data exfiltration

SourceSKILL.md
198> **CRITICAL**: Save the `secret` - you'll need it to verify webhook signatures. It's only shown once!
medium line 200

Webhook reference - potential data exfiltration

SourceSKILL.md
200### Step 2: List Webhooks
low line 203

Webhook reference - potential data exfiltration

SourceSKILL.md
203curl https://core.interactor.com/api/v1/webhooks \
low line 211

Webhook reference - potential data exfiltration

SourceSKILL.md
211"webhooks": [
low line 214

Webhook reference - potential data exfiltration

SourceSKILL.md
214"url": "https://yourapp.com/webhooks/interactor",
medium line 226

Webhook reference - potential data exfiltration

SourceSKILL.md
226### Step 3: Get Webhook Details
low line 229

Webhook reference - potential data exfiltration

SourceSKILL.md
229curl https://core.interactor.com/api/v1/webhooks/wh_abc \
medium line 233

Webhook reference - potential data exfiltration

SourceSKILL.md
233### Step 4: Update Webhook
low line 236

Webhook reference - potential data exfiltration

SourceSKILL.md
236curl -X PUT https://core.interactor.com/api/v1/webhooks/wh_abc \
low line 241

Webhook reference - potential data exfiltration

SourceSKILL.md
241"url": "https://yourapp.com/webhooks/v2/interactor"
medium line 245

Webhook reference - potential data exfiltration

SourceSKILL.md
245### Step 5: Toggle Webhook (Enable/Disable)
low line 248

Webhook reference - potential data exfiltration

SourceSKILL.md
248curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/toggle \
medium line 252

Webhook reference - potential data exfiltration

SourceSKILL.md
252### Step 6: Delete Webhook
low line 255

Webhook reference - potential data exfiltration

SourceSKILL.md
255curl -X DELETE https://core.interactor.com/api/v1/webhooks/wh_abc \
low line 264

Webhook reference - potential data exfiltration

SourceSKILL.md
264curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/regenerate-secret \
medium line 279

Webhook reference - potential data exfiltration

SourceSKILL.md
279> **CRITICAL**: The new secret is only shown once. Update your webhook handler immediately with the new secret.
low line 286

Webhook reference - potential data exfiltration

SourceSKILL.md
286curl https://core.interactor.com/api/v1/webhooks/wh_abc/events \
medium line 316

Webhook reference - potential data exfiltration

SourceSKILL.md
316### Step 9: Test Webhook
low line 321

Webhook reference - potential data exfiltration

SourceSKILL.md
321curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/test \
medium line 327

Webhook reference - potential data exfiltration

SourceSKILL.md
327## Webhook Payload Format
medium line 329

Webhook reference - potential data exfiltration

SourceSKILL.md
329All webhook events follow this structure:
medium line 531

Webhook reference - potential data exfiltration

SourceSKILL.md
531## Verifying Webhook Signatures
medium line 533

Webhook reference - potential data exfiltration

SourceSKILL.md
533**CRITICAL**: Always verify signatures to ensure webhooks came from Interactor.
medium line 537

Webhook reference - potential data exfiltration

SourceSKILL.md
537Webhooks include two headers for verification:
medium line 578

Webhook reference - potential data exfiltration

SourceSKILL.md
578When rotating webhook secrets, you may have a period where both old and new secrets are valid:
low line 595

Webhook reference - potential data exfiltration

SourceSKILL.md
595const WEBHOOK_SECRETS = [
low line 596

Webhook reference - potential data exfiltration

SourceSKILL.md
596process.env.INTERACTOR_WEBHOOK_SECRET!, // Current secret
low line 597

Webhook reference - potential data exfiltration

SourceSKILL.md
597process.env.INTERACTOR_WEBHOOK_SECRET_PREVIOUS!, // Previous secret (optional)
medium line 603

Webhook reference - potential data exfiltration

SourceSKILL.md
6032. Deploy new secret to `INTERACTOR_WEBHOOK_SECRET`
medium line 604

Webhook reference - potential data exfiltration

SourceSKILL.md
6043. Keep old secret in `INTERACTOR_WEBHOOK_SECRET_PREVIOUS` for 24-48 hours
low line 632

Webhook reference - potential data exfiltration

SourceSKILL.md
632* Validates and verifies the webhook signature using timing-safe comparison.
low line 670

Webhook reference - potential data exfiltration

SourceSKILL.md
670'/webhooks/interactor',
low line 679

Webhook reference - potential data exfiltration

SourceSKILL.md
679console.warn('Webhook rejected: invalid or stale timestamp');
low line 684

Webhook reference - potential data exfiltration

SourceSKILL.md
684if (!isValidSignature(signatureHeader, payload, process.env.INTERACTOR_WEBHOOK_SECRET!)) {
low line 685

Webhook reference - potential data exfiltration

SourceSKILL.md
685console.warn('Webhook rejected: invalid signature');
low line 690

Webhook reference - potential data exfiltration

SourceSKILL.md
690let event: WebhookEvent;
low line 700

Webhook reference - potential data exfiltration

SourceSKILL.md
700handleWebhookEvent(event).catch((err) => {
low line 709

Webhook reference - potential data exfiltration

SourceSKILL.md
709async function handleWebhookEvent(event: WebhookEvent) {
low line 759

Webhook reference - potential data exfiltration

SourceSKILL.md
759// Webhook event types for type safety
low line 760

Webhook reference - potential data exfiltration

SourceSKILL.md
760type WebhookEventType =
low line 772

Webhook reference - potential data exfiltration

SourceSKILL.md
772// SSE-only event types (not available via webhooks)
low line 787

Webhook reference - potential data exfiltration

SourceSKILL.md
787interface WebhookEvent<T = Record<string, unknown>> {
low line 789

Webhook reference - potential data exfiltration

SourceSKILL.md
789type: WebhookEventType;
low line 870

Webhook reference - potential data exfiltration

SourceSKILL.md
870Validate and verify webhook signature with timing-safe comparison.
low line 891

Webhook reference - potential data exfiltration

SourceSKILL.md
891@app.route('/webhooks/interactor', methods=['POST'])
low line 892

Webhook reference - potential data exfiltration

SourceSKILL.md
892def handle_webhook():
low line 899

Webhook reference - potential data exfiltration

SourceSKILL.md
899print('Webhook rejected: invalid or stale timestamp')
low line 903

Webhook reference - potential data exfiltration

SourceSKILL.md
903if not is_valid_signature(signature_header, payload, os.environ['INTERACTOR_WEBHOOK_SECRET']):
low line 904

Webhook reference - potential data exfiltration

SourceSKILL.md
904print('Webhook rejected: invalid signature')
low line 916

Webhook reference - potential data exfiltration

SourceSKILL.md
916handle_webhook_event(event)
low line 921

Webhook reference - potential data exfiltration

SourceSKILL.md
921def handle_webhook_event(event: dict):
low line 958

Webhook reference - potential data exfiltration

SourceSKILL.md
958defmodule MyAppWeb.WebhookController do
low line 963

Webhook reference - potential data exfiltration

SourceSKILL.md
963# Maximum body size for webhooks (1MB should be plenty)
low line 976

Webhook reference - potential data exfiltration

SourceSKILL.md
976secret <- Application.fetch_env!(:my_app, :interactor_webhook_secret),
medium line 1089

Webhook reference - potential data exfiltration

SourceSKILL.md
1089Interactor retries failed webhook deliveries with exponential backoff:
medium line 1099

Webhook reference - potential data exfiltration

SourceSKILL.md
1099After 5 failed attempts, the webhook is **disabled**. Re-enable via the toggle endpoint.
medium line 1103

Webhook reference - potential data exfiltration

SourceSKILL.md
1103Your webhook handler's HTTP response determines Interactor's retry behavior:
low line 1134

Webhook reference - potential data exfiltration

SourceSKILL.md
1134async function handleWebhookEvent(event: WebhookEvent) {
low line 1135

Webhook reference - potential data exfiltration

SourceSKILL.md
1135const idempotencyKey = `webhook:processed:${event.id}`;
low line 1170

Webhook reference - potential data exfiltration

SourceSKILL.md
1170const DLQ_KEY = 'webhook:dlq';
low line 1172

Webhook reference - potential data exfiltration

SourceSKILL.md
1172async function handleWebhookEvent(event: WebhookEvent) {
low line 1173

Webhook reference - potential data exfiltration

SourceSKILL.md
1173const attemptKey = `webhook:attempts:${event.id}`;
low line 1193

Webhook reference - potential data exfiltration

SourceSKILL.md
1193await alertOps(`Webhook event ${event.id} failed ${attempts} times`);
medium line 1216

Webhook reference - potential data exfiltration

SourceSKILL.md
1216Track webhook health with these metrics:
low line 1223

Webhook reference - potential data exfiltration

SourceSKILL.md
1223// Webhook metrics
low line 1224

Webhook reference - potential data exfiltration

SourceSKILL.md
1224const webhookReceived = new Counter({
low line 1225

Webhook reference - potential data exfiltration

SourceSKILL.md
1225name: 'interactor_webhook_received_total',
low line 1226

Webhook reference - potential data exfiltration

SourceSKILL.md
1226help: 'Total webhooks received',
low line 1230

Webhook reference - potential data exfiltration

SourceSKILL.md
1230const webhookProcessingDuration = new Histogram({
low line 1231

Webhook reference - potential data exfiltration

SourceSKILL.md
1231name: 'interactor_webhook_processing_duration_seconds',
low line 1232

Webhook reference - potential data exfiltration

SourceSKILL.md
1232help: 'Webhook processing duration in seconds',
low line 1237

Webhook reference - potential data exfiltration

SourceSKILL.md
1237const webhookDLQSize = new Gauge({
low line 1238

Webhook reference - potential data exfiltration

SourceSKILL.md
1238name: 'interactor_webhook_dlq_size',
low line 1243

Webhook reference - potential data exfiltration

SourceSKILL.md
1243app.post('/webhooks/interactor', async (req, res) => {
low line 1244

Webhook reference - potential data exfiltration

SourceSKILL.md
1244const timer = webhookProcessingDuration.startTimer();
low line 1250

Webhook reference - potential data exfiltration

SourceSKILL.md
1250webhookReceived.inc({ event_type: 'unknown', status: 'invalid_signature' });
low line 1255

Webhook reference - potential data exfiltration

SourceSKILL.md
1255webhookReceived.inc({ event_type: event.type, status: 'success' });
low line 1257

Webhook reference - potential data exfiltration

SourceSKILL.md
1257await handleWebhookEvent(event);
low line 1262

Webhook reference - potential data exfiltration

SourceSKILL.md
1262webhookReceived.inc({ event_type: 'unknown', status: 'processing_error' });
medium line 1273

Webhook reference - potential data exfiltration

SourceSKILL.md
1273| `webhook_received_total{status="invalid_signature"}` | >5 in 5min | Possible secret mismatch or attack |
medium line 1274

Webhook reference - potential data exfiltration

SourceSKILL.md
1274| `webhook_processing_duration_seconds` | p99 >5s | Risk of timeout, scale handlers |
medium line 1275

Webhook reference - potential data exfiltration

SourceSKILL.md
1275| `webhook_dlq_size` | >0 | Events need manual review |
medium line 1276

Webhook reference - potential data exfiltration

SourceSKILL.md
1276| `webhook_received_total{status="processing_error"}` | >10 in 5min | Handler bugs, investigate logs |
medium line 1890

Webhook reference - potential data exfiltration

SourceSKILL.md
1890| Webhooks per account | 50 |
medium line 1892

Webhook reference - potential data exfiltration

SourceSKILL.md
1892| Events per webhook | Unlimited |
medium line 1898

Webhook reference - potential data exfiltration

SourceSKILL.md
1898### Webhooks
medium line 1904

Webhook reference - potential data exfiltration

SourceSKILL.md
19045. **Monitor delivery** - Check webhook events list for failures
medium line 1905

Webhook reference - potential data exfiltration

SourceSKILL.md
19056. **Use HTTPS** - Required for production webhooks
medium line 1913

Webhook reference - potential data exfiltration

SourceSKILL.md
19135. **Use for frontend only** - For backend, prefer webhooks
medium line 1919

Webhook reference - potential data exfiltration

SourceSKILL.md
1919### Testing Webhooks Locally
medium line 1921

Webhook reference - potential data exfiltration

SourceSKILL.md
1921Webhooks require a publicly accessible URL. For local development:
low line 1928

Webhook reference - potential data exfiltration

SourceSKILL.md
1928# Use the generated URL for your webhook
low line 1929

Webhook reference - potential data exfiltration

SourceSKILL.md
1929# Example: https://abc123.ngrok.io/webhooks/interactor
low line 1937

Webhook reference - potential data exfiltration

SourceSKILL.md
1937# Use the generated URL for your webhook
medium line 1945

Webhook reference - potential data exfiltration

SourceSKILL.md
1945### Testing Webhook Signature Verification
low line 1950

Webhook reference - potential data exfiltration

SourceSKILL.md
1950// test-webhook-signature.ts
low line 1970

Webhook reference - potential data exfiltration

SourceSKILL.md
1970// curl -X POST http://localhost:4000/webhooks/interactor \
low line 1981

Webhook reference - potential data exfiltration

SourceSKILL.md
1981curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/test \
medium line 1985

Webhook reference - potential data exfiltration

SourceSKILL.md
1985This sends a test event to your webhook URL to verify it's working.
medium line 1989

Webhook reference - potential data exfiltration

SourceSKILL.md
1989Import this collection to test webhook handling:
low line 1993

Webhook reference - potential data exfiltration

SourceSKILL.md
1993"info": { "name": "Interactor Webhooks", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" },
low line 1995

Webhook reference - potential data exfiltration

SourceSKILL.md
1995{ "key": "webhook_secret", "value": "whsec_your_test_secret" },
low line 1996

Webhook reference - potential data exfiltration

SourceSKILL.md
1996{ "key": "webhook_url", "value": "http://localhost:4000/webhooks/interactor" }
low line 2000

Webhook reference - potential data exfiltration

SourceSKILL.md
2000"name": "Test Webhook - Credential Expired",
low line 2003

Webhook reference - potential data exfiltration

SourceSKILL.md
2003"url": "{{webhook_url}}",
low line 2024

Webhook reference - potential data exfiltration

SourceSKILL.md
2024const signature = crypto.HmacSHA256(payload, pm.variables.get('webhook_secret')).toString();
low line 2038

Webhook reference - potential data exfiltration

SourceSKILL.md
2038describe('Webhook Handler', () => {
low line 2039

Webhook reference - potential data exfiltration

SourceSKILL.md
2039const WEBHOOK_SECRET = 'whsec_test_secret_123';
low line 2042

Webhook reference - potential data exfiltration

SourceSKILL.md
2042process.env.INTERACTOR_WEBHOOK_SECRET = WEBHOOK_SECRET;
low line 2046

Webhook reference - potential data exfiltration

SourceSKILL.md
2046return 'sha256=' + crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
low line 2053

Webhook reference - potential data exfiltration

SourceSKILL.md
2053it('accepts valid webhook', async () => {
low line 2062

Webhook reference - potential data exfiltration

SourceSKILL.md
2062.post('/webhooks/interactor')
low line 2076

Webhook reference - potential data exfiltration

SourceSKILL.md
2076.post('/webhooks/interactor')
low line 2090

Webhook reference - potential data exfiltration

SourceSKILL.md
2090.post('/webhooks/interactor')
low line 2104

Webhook reference - potential data exfiltration

SourceSKILL.md
2104.post('/webhooks/interactor')
low line 2125

Webhook reference - potential data exfiltration

SourceSKILL.md
2125.post('/webhooks/interactor')
low line 2133

Webhook reference - potential data exfiltration

SourceSKILL.md
2133.post('/webhooks/interactor')
low line 2150

Webhook reference - potential data exfiltration

SourceSKILL.md
2150// scripts/replay-webhook-events.ts
low line 2155

Webhook reference - potential data exfiltration

SourceSKILL.md
2155webhookUrl: string;
low line 2156

Webhook reference - potential data exfiltration

SourceSKILL.md
2156webhookSecret: string;
low line 2161

Webhook reference - potential data exfiltration

SourceSKILL.md
2161async function replayEvents({ webhookUrl, webhookSecret, events, delayMs = 100 }: ReplayOptions) {
low line 2172

Webhook reference - potential data exfiltration

SourceSKILL.md
2172.createHmac('sha256', webhookSecret)
low line 2177

Webhook reference - potential data exfiltration

SourceSKILL.md
2177const res = await fetch(webhookUrl, {
low line 2203

Webhook reference - potential data exfiltration

SourceSKILL.md
2203webhookUrl: 'http://localhost:4000/webhooks/interactor',
low line 2204

Webhook reference - potential data exfiltration

SourceSKILL.md
2204webhookSecret: process.env.INTERACTOR_WEBHOOK_SECRET!,
medium line 2213

Webhook reference - potential data exfiltration

SourceSKILL.md
2213### Webhook API Errors
medium line 2217

Webhook reference - potential data exfiltration

SourceSKILL.md
2217| `webhook_not_found` | 404 | Webhook ID doesn't exist | Verify webhook ID, may have been deleted |
medium line 2220

Webhook reference - potential data exfiltration

SourceSKILL.md
2220| `webhook_disabled` | 400 | Webhook disabled after failures | Fix endpoint issues, then toggle to re-enable |
medium line 2221

Webhook reference - potential data exfiltration

SourceSKILL.md
2221| `max_webhooks_exceeded` | 400 | Account webhook limit reached | Delete unused webhooks or contact support |
medium line 2222

Webhook reference - potential data exfiltration

SourceSKILL.md
2222| `url_unreachable` | 400 | Cannot reach webhook URL | Ensure URL is publicly accessible |
medium line 2228

Webhook reference - potential data exfiltration

SourceSKILL.md
2228### Webhook Delivery Errors
medium line 2297

Webhook reference - potential data exfiltration

SourceSKILL.md
2297When implementing webhooks/streaming, provide this summary:
low line 2300

Webhook reference - potential data exfiltration

SourceSKILL.md
2300## Webhooks & Streaming Implementation Report
low line 2304

Webhook reference - potential data exfiltration

SourceSKILL.md
2304### Webhooks Configured
low line 2305

Webhook reference - potential data exfiltration

SourceSKILL.md
2305| Webhook ID | URL | Events | Status |
low line 2307

Webhook reference - potential data exfiltration

SourceSKILL.md
2307| wh_abc | https://app.com/webhooks | credential.*, workflow.* | ✓ Active |
low line 2328

Webhook reference - potential data exfiltration

SourceSKILL.md
2328- [ ] Webhook endpoint uses HTTPS (required for production)
low line 2332

Webhook reference - potential data exfiltration

SourceSKILL.md
2332- [ ] Webhook secret stored in environment variable (not in code)
low line 2337

Webhook reference - potential data exfiltration

SourceSKILL.md
2337- [ ] Respond to webhooks within 5 seconds
low line 2345

Webhook reference - potential data exfiltration

SourceSKILL.md
2345- [ ] Webhook received counter (by event_type, status)
low line 2361

Webhook reference - potential data exfiltration

SourceSKILL.md
2361- [ ] Integration tests with test webhook endpoint
high line 1923

Ngrok tunnel reference

SourceSKILL.md
1923**Option 1: ngrok (Recommended)**
medium line 1925

Ngrok tunnel reference

SourceSKILL.md
1925# Install ngrok: https://ngrok.com/download
medium line 1926

Ngrok tunnel reference

SourceSKILL.md
1926ngrok http 4000 # For Phoenix default port
medium line 1929

Ngrok tunnel reference

SourceSKILL.md
1929# Example: https://abc123.ngrok.io/webhooks/interactor
low line 596

Access to .env file

SourceSKILL.md
596process.env.INTERACTOR_WEBHOOK_SECRET!, // Current secret
low line 597

Access to .env file

SourceSKILL.md
597process.env.INTERACTOR_WEBHOOK_SECRET_PREVIOUS!, // Previous secret (optional)
low line 684

Access to .env file

SourceSKILL.md
684if (!isValidSignature(signatureHeader, payload, process.env.INTERACTOR_WEBHOOK_SECRET!)) {
low line 1367

Access to .env file

SourceSKILL.md
1367process.env.SSE_TOKEN_SECRET,
low line 1400

Access to .env file

SourceSKILL.md
1400{ headers: { 'Authorization': `Bearer ${process.env.INTERACTOR_ACCESS_TOKEN}` } }
low line 1868

Access to .env file

SourceSKILL.md
1868process.env.INTERACTOR_ACCESS_TOKEN!
low line 2042

Access to .env file

SourceSKILL.md
2042process.env.INTERACTOR_WEBHOOK_SECRET = WEBHOOK_SECRET;
low line 2204

Access to .env file

SourceSKILL.md
2204webhookSecret: process.env.INTERACTOR_WEBHOOK_SECRET!,
low line 47

External URL reference

SourceSKILL.md
47curl https://core.interactor.com/api/v1/webhooks/event-types \
low line 150

External URL reference

SourceSKILL.md
150curl -X POST https://core.interactor.com/api/v1/tokens \
low line 164

External URL reference

SourceSKILL.md
164curl -X POST https://core.interactor.com/api/v1/webhooks \
low line 168

External URL reference

SourceSKILL.md
168"url": "https://yourapp.com/webhooks/interactor",
low line 184

External URL reference

SourceSKILL.md
184"url": "https://yourapp.com/webhooks/interactor",
low line 203

External URL reference

SourceSKILL.md
203curl https://core.interactor.com/api/v1/webhooks \
low line 214

External URL reference

SourceSKILL.md
214"url": "https://yourapp.com/webhooks/interactor",
low line 229

External URL reference

SourceSKILL.md
229curl https://core.interactor.com/api/v1/webhooks/wh_abc \
low line 236

External URL reference

SourceSKILL.md
236curl -X PUT https://core.interactor.com/api/v1/webhooks/wh_abc \
low line 241

External URL reference

SourceSKILL.md
241"url": "https://yourapp.com/webhooks/v2/interactor"
low line 248

External URL reference

SourceSKILL.md
248curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/toggle \
low line 255

External URL reference

SourceSKILL.md
255curl -X DELETE https://core.interactor.com/api/v1/webhooks/wh_abc \
low line 264

External URL reference

SourceSKILL.md
264curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/regenerate-secret \
low line 286

External URL reference

SourceSKILL.md
286curl https://core.interactor.com/api/v1/webhooks/wh_abc/events \
low line 321

External URL reference

SourceSKILL.md
321curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/test \
low line 1289

External URL reference

SourceSKILL.md
1289curl -N https://core.interactor.com/api/v1/workflows/instances/inst_xyz/stream \
low line 1317

External URL reference

SourceSKILL.md
1317curl -N https://core.interactor.com/api/v1/agents/rooms/room_xyz/stream \
low line 1399

External URL reference

SourceSKILL.md
1399`https://core.interactor.com/api/v1/agents/rooms/${req.params.roomId}/stream`,
low line 1419

External URL reference

SourceSKILL.md
1419// Access-Control-Allow-Origin: https://yourdomain.com
low line 1423

External URL reference

SourceSKILL.md
1423// connect-src 'self' https://core.interactor.com;
low line 1477

External URL reference

SourceSKILL.md
1477`https://core.interactor.com/api/v1/agents/rooms/${roomId}/stream?token=${token}`
low line 1571

External URL reference

SourceSKILL.md
1571const url = `https://core.interactor.com/api/v1/agents/rooms/${roomId}/stream?token=${token}`;
low line 1867

External URL reference

SourceSKILL.md
1867'https://core.interactor.com/api/v1',
low line 1925

External URL reference

SourceSKILL.md
1925# Install ngrok: https://ngrok.com/download
low line 1929

External URL reference

SourceSKILL.md
1929# Example: https://abc123.ngrok.io/webhooks/interactor
low line 1942

External URL reference

SourceSKILL.md
1942cloudflared tunnel --url http://localhost:4000
low line 1970

External URL reference

SourceSKILL.md
1970// curl -X POST http://localhost:4000/webhooks/interactor \
low line 1981

External URL reference

SourceSKILL.md
1981curl -X POST https://core.interactor.com/api/v1/webhooks/wh_abc/test \
low line 1993

External URL reference

SourceSKILL.md
1993"info": { "name": "Interactor Webhooks", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" },
low line 1996

External URL reference

SourceSKILL.md
1996{ "key": "webhook_url", "value": "http://localhost:4000/webhooks/interactor" }
low line 2203

External URL reference

SourceSKILL.md
2203webhookUrl: 'http://localhost:4000/webhooks/interactor',
low line 2218

External URL reference

SourceSKILL.md
2218| `invalid_url` | 400 | URL not valid HTTPS | Use `https://` URL (HTTP only in dev) |
low line 2280

External URL reference

SourceSKILL.md
2280const response = await fetch(`https://core.interactor.com/api/v1${endpoint}`, options);
low line 2307

External URL reference

SourceSKILL.md
2307| wh_abc | https://app.com/webhooks | credential.*, workflow.* | ✓ Active |
Scanned on Feb 12, 2026
View Security Dashboard
Installation guide →
GitHub Stars 106
Rate this skill
Categorydevelopment
UpdatedMay 21, 2026
openclawapibackend-developerdata-engineerproduct-managergrowth-pmtechnical-pmdevelopmentproduct
majiayu000/claude-skill-registry