Webhooks

result = await client.run_task(
    prompt="Get the price of this product",
    url="https://example.com/product/123",
    webhook_url="https://your-server.com/webhook",
)

const result = await client.runTask({
  body: {
    prompt: "Get the price of this product",
    url: "https://example.com/product/123",
    webhook_url: "https://your-server.com/webhook",
  },
});

curl -X POST "https://api.skyvern.com/v1/run/tasks" \
  -H "x-api-key: $SKYVERN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "prompt": "Get the price of this product",
    "url": "https://example.com/product/123",
    "webhook_url": "https://your-server.com/webhook"
  }'

# Set default on workflow (webhook_callback_url goes inside json_definition)
workflow = await client.create_workflow(
    json_definition={
        "title": "Invoice Downloader",
        "webhook_callback_url": "https://your-server.com/webhook",
        "workflow_definition": {
            "parameters": [],
            "blocks": [
                {
                    "block_type": "task",
                    "label": "download_invoice",
                    "url": "https://vendor-portal.example.com",
                    "prompt": "Download the latest invoice"
                }
            ]
        }
    }
)

# Override for a specific run
run = await client.run_workflow(
    workflow_id=workflow.workflow_permanent_id,
    parameters={},
    webhook_url="https://your-server.com/different-webhook"
)

// Set default on workflow (webhook_callback_url goes inside json_definition)
const workflow = await client.createWorkflow({
  body: {
    json_definition: {
      title: "Invoice Downloader",
      webhook_callback_url: "https://your-server.com/webhook",
      workflow_definition: {
        parameters: [],
        blocks: [
          {
            block_type: "task",
            label: "download_invoice",
            url: "https://vendor-portal.example.com",
            prompt: "Download the latest invoice",
          },
        ],
      },
    },
  },
});

// Override for a specific run
const run = await client.runWorkflow({
  body: {
    workflow_id: workflow.workflow_permanent_id,
    parameters: {},
    webhook_url: "https://your-server.com/different-webhook",
  },
});

# Set default on workflow (webhook_callback_url goes inside json_definition)
curl -X POST "https://api.skyvern.com/v1/workflows" \
  -H "x-api-key: $SKYVERN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "json_definition": {
      "title": "Invoice Downloader",
      "webhook_callback_url": "https://your-server.com/webhook",
      "workflow_definition": {
        "parameters": [],
        "blocks": [
          {
            "block_type": "task",
            "label": "download_invoice",
            "url": "https://vendor-portal.example.com",
            "prompt": "Download the latest invoice"
          }
        ]
      }
    }
  }'

# Override for a specific run (use workflow_permanent_id from create response)
curl -X POST "https://api.skyvern.com/v1/run/workflows" \
  -H "x-api-key: $SKYVERN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "workflow_id": "wpid_123456789",
    "parameters": {},
    "webhook_url": "https://your-server.com/different-webhook"
  }'

import hashlib
import hmac
import os

from fastapi import HTTPException, Request

SKYVERN_API_KEY = os.environ["SKYVERN_API_KEY"]


def verify_skyvern_signature(raw_body: bytes, signature: str | None) -> bool:
    if not signature:
        return False
    expected = hmac.new(
        SKYVERN_API_KEY.encode("utf-8"),
        msg=raw_body,
        digestmod=hashlib.sha256,
    ).hexdigest()
    # Compared as bytes: compare_digest raises TypeError on a non-ASCII str,
    # and the signature header is attacker-controlled.
    return hmac.compare_digest(signature.encode("utf-8"), expected.encode("utf-8"))


async def handle_webhook(request: Request):
    raw_body = await request.body()
    signature = request.headers.get("x-skyvern-signature")

    if not verify_skyvern_signature(raw_body, signature):
        raise HTTPException(status_code=401, detail="Invalid signature")

    data = await request.json()
    # Process the request...

import crypto from "crypto";
import express from "express";

function verifySkyvernSignature(rawBody: Buffer, signature: unknown): boolean {
  if (typeof signature !== "string" || signature.length === 0) {
    return false;
  }
  const apiKey = process.env.SKYVERN_API_KEY;
  if (!apiKey) {
    throw new Error("SKYVERN_API_KEY is not set");
  }
  const expected = crypto.createHmac("sha256", apiKey).update(rawBody).digest("hex");
  const received = Buffer.from(signature, "utf8");
  const digest = Buffer.from(expected, "utf8");
  // timingSafeEqual throws unless both buffers are the same length, so compare
  // lengths first and return its result -- never discard it.
  return received.length === digest.length && crypto.timingSafeEqual(received, digest);
}

app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifySkyvernSignature(req.body, req.headers["x-skyvern-signature"])) {
    return res.status(401).send("Invalid signature");
  }

  const data = JSON.parse(req.body);
  // Process the request...
  res.status(200).send("OK");
});

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "os"
)

func verifySkyvernSignature(rawBody []byte, signature string) bool {
    apiKey := os.Getenv("SKYVERN_API_KEY")
    // Without this, an unset key would sign with "" -- a key an attacker also knows.
    if signature == "" || apiKey == "" {
        return false
    }
    mac := hmac.New(sha256.New, []byte(apiKey))
    mac.Write(rawBody)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signature), []byte(expected))
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    rawBody, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Failed to read request body", http.StatusBadRequest)
        return
    }

    if !verifySkyvernSignature(rawBody, r.Header.Get("x-skyvern-signature")) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    // Process the request...
    w.WriteHeader(http.StatusOK)
}

run = await client.get_run(run_id)

if run.status == "failed" and "webhook" in (run.failure_reason or "").lower():
    print(f"Webhook failed: {run.failure_reason}")
    # The task may have completed successfully before webhook delivery failed
    # Output data is still available
    if run.output:
        process_output(run.output)

const run = await client.getRun(runId);

if (run.status === "failed" && run.failure_reason?.toLowerCase().includes("webhook")) {
  console.log(`Webhook failed: ${run.failure_reason}`);
  // The task may have completed successfully before webhook delivery failed
  // Output data is still available
  if (run.output) {
    processOutput(run.output);
  }
}

curl -X GET "https://api.skyvern.com/v1/runs/$RUN_ID" \
  -H "x-api-key: $SKYVERN_API_KEY"

# Check status and failure_reason fields in response

from skyvern.client import RetryRunWebhookRequest

await client.retry_run_webhook("tsk_v2_486305187432193504")

# Or send to a different URL
await client.retry_run_webhook(
    "tsk_v2_486305187432193504",
    request=RetryRunWebhookRequest(webhook_url="https://your-server.com/new-webhook")
)

await client.retryRunWebhook("tsk_v2_486305187432193504");

// Or send to a different URL
await client.retryRunWebhook("tsk_v2_486305187432193504", {
  webhook_url: "https://your-server.com/new-webhook",
});

curl -X POST "https://api.skyvern.com/v1/runs/tsk_v2_486305187432193504/retry_webhook" \
  -H "x-api-key: $SKYVERN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

# Or send to a different URL
curl -X POST "https://api.skyvern.com/v1/runs/tsk_v2_486305187432193504/retry_webhook" \
  -H "x-api-key: $SKYVERN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"webhook_url": "https://your-server.com/new-webhook"}'