terraform-provider-stackgen

sg_webhook (Resource)

⚠️ Experimental — This resource is part of the Guild platform and may change in future releases.

Manages an incoming HTTP webhook that starts an sg_agent or sg_workflow run when triggered externally. Use target_type = agent or workflow and target_name = the agent or workflow name (same pairing as sg_agent_schedule).

The trigger token is sensitive and returned on create and whenever token_rotation changes.

Set provider workspace_id to create the webhook in the same workspace as agents, workflows, and schedules.

Example Usage

# When to use: Incoming HTTP webhook that triggers an agent or workflow run
# (PagerDuty, custom CI, etc.). For SRE Copilot alert ingest use
# sg_sre_alert_webhook instead — generic sg_webhook is insufficient for that path.
#
# Prerequisites: existing agent or workflow name; provider workspace_id for org scope.
#
# Related: sg_agent / sg_workflow, sg_notification_channel, sg_sre_alert_webhook.
resource "sg_webhook" "example" {
  name        = "incident-intake"
  target_type = "agent"
  target_name = "my-agent"
  action      = "Triage the incoming payload and extract severity and service."
  enabled     = true

  # Bump this string to rotate the trigger token in place (sensitive; stored in state).
  # token_rotation = "v2"
}

Import

Import an existing sg_webhook using its webhook UUID:

terraform import sg_webhook.example '123e4567-e89b-12d3-a456-426614174000'

Operational notes

Import by webhook UUID. The trigger token may be omitted on later reads; preserve the create-time token in state and secure plans.

Schema

Required

• action (String) Prompt or instruction sent when the webhook is triggered (agent/workflow targets). Guild allows in-place updates via the update webhook API.
• name (String) Human-readable name for this webhook task (Guild pattern: letters digits spaces underscore hyphen dot).
• target_name (String) Name of the agent, workflow, or installed app this webhook invokes (same semantics as sg_agent_schedule).
• target_type (String) Either agent, workflow, or app — must match the resource identified by target_name (same values as sg_agent_schedule).

Optional

• allowed_cidrs (List of String) CIDR blocks allowed to invoke this webhook (e.g. 192.168.1.0/24). Empty means any source IP.
• enabled (Boolean) Whether the webhook accepts HTTP triggers. Defaults to true.
• endpoint_path (String) Relative POST path on the app install endpoint. Required when target_type is app; empty for agent and workflow targets.
• notification_channel_ids (List of String) UUIDs of sg_notification_channel resources notified on run success or failure. Empty list clears all channels.
• token_rotation (String) Arbitrary string stored in state; changing it rotates the token via the Guild API.

Read-Only

• created_at (String) Creation timestamp (RFC 3339).
• id (String) Server-assigned webhook UUID.
• token (String, Sensitive) Secret token used to authenticate trigger requests. Returned on create and when token_rotation changes.
• updated_at (String) Last modification timestamp (RFC 3339).