A Webhook trigger starts a workflow when an external system sends an HTTP request to a URL generated by MergePoint. Use it to integrate with any service that can make HTTP calls.
Setup
In the Start node inspector, select Webhook. MergePoint generates a unique URL for the workflow. This URL is active once the workflow is published.
HTTP Method
Choose which HTTP method the webhook listens for:
GETPOST(default)PUTPATCHDELETE
Webhook Path
By default, MergePoint generates a unique random path. You can override this with a custom path (e.g. /orders/inbound) if you need a predictable endpoint. Custom paths must be unique across your workspace.
Authentication
Control which callers can trigger the webhook:
| Auth type | How it works |
|---|---|
| None | No authentication — anyone with the URL can trigger it |
| Basic | Username and password sent in the Authorization header |
| Header | A specific header name and value must be present on the request |
| Query parameter | A specific query parameter name and value must be present in the URL |
You can also enable a Webhook secret — a shared HMAC secret used to verify that requests come from a trusted sender.
Payload Schema
Optionally define the expected shape of the incoming request body. This lets you reference specific fields in downstream steps by name rather than navigating the raw payload.
Response Configuration
Choose how MergePoint responds to the caller after the trigger fires:
| Mode | Behaviour |
|---|---|
| On received | Responds immediately when the request arrives, before any steps run |
| When last node finishes | Waits for the full workflow to complete, then responds with data from the final step |
| Respond from node | A dedicated Respond to Webhook node in the workflow controls the response manually |
When responding with data, choose what to include:
- First entry — returns a single JSON object
- All entries — returns an array of all results
- No response body — returns only a status code
You can also set a custom HTTP response code and add custom response headers.
Advanced Options
- Raw body — accept the request body as plain text rather than parsing it as JSON
- Ignore bots — skip requests from known link previewers and crawlers
- Binary data — accept file uploads (images, PDFs, etc.) via
POST,PUT, orPATCH - Allowed origins (CORS) — restrict which domains can send browser-based requests
- Deduplication key — a field in the payload used to detect and discard duplicate requests
Activation
The webhook URL is only active after the workflow is published. Requests sent before publishing are not processed.