You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[BUG] Generic webhook does not accept the methods, headers, or query parameters its Setup Instructions promise #6888
The generic webhook trigger's Setup Instructions promise three things the endpoint does not do:
Setup Instructions say
Actual behavior
"The webhook accepts any HTTP method (GET, POST, PUT, DELETE)"
apps/sim/app/api/webhooks/trigger/[path]/route.ts only exports POST (and a GET challenge/delivery path), so PUT/PATCH/DELETE get 405
"headers, body, and query parameters are available in your workflow"
the generic provider's formatInput (apps/sim/lib/webhooks/providers/generic.ts) returns only the body — request headers are used solely for the idempotency key and signature checks
the HTTP method used for the delivery
not carried into the execution payload at all, so a workflow behind one URL cannot tell a create from a delete
The trigger also declares outputs: {}, so the reference dropdown in the editor offers no completions for the request metadata and users have to type paths by hand.
A concrete consequence: a webhook URL sent in an email cannot be triggered by clicking the link, because a plain browser GET used to answer 405. (GET delivery is the one part that has since been addressed.)
To Reproduce
Create a workflow with a Webhook trigger, provider "Generic".
Read the Setup Instructions shown in the trigger's config panel.
curl -X PUT "$WEBHOOK_URL?id=42" -H 'X-Custom: hello' -d '{}' → 405 Method Not Allowed.
curl -X POST "$WEBHOOK_URL?id=42" -H 'X-Custom: hello' -d '{"a":1}' → 200, but the workflow input contains only {"a":1}: no headers, no query, no method.
Expected behavior
The endpoint should behave the way the Setup Instructions describe: accept the documented HTTP methods for the generic provider, and expose the request method, query parameters, and request headers to the workflow — with credential-bearing headers withheld so they don't end up in execution logs. Providers other than generic should keep answering 405 for non-POST deliveries.
Additional context
The Setup Instructions text was introduced in #903; the route at that commit already accepted only GET and POST, so this is not a regression — the documentation was ahead of the implementation from the start. Happy to open a PR against staging; I have the change implemented and tested locally.
Activity
fix(webhooks): stop provider challenges from intercepting other provi…
fix(webhooks): accept the methods and expose the request metadata the…
waleedlatif1 commentedon Aug 24, 2026
resolved in #6893