curl --request POST \
--url https://api.example.com/api/hooks/trigger-links \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"execution_key": "<string>",
"topic": "<string>",
"ttl_seconds": 123,
"name": "<string>",
"require_api_key": false,
"tool_kwargs": {}
}
'import requests
url = "https://api.example.com/api/hooks/trigger-links"
payload = {
"execution_key": "<string>",
"topic": "<string>",
"ttl_seconds": 123,
"name": "<string>",
"require_api_key": False,
"tool_kwargs": {}
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
execution_key: '<string>',
topic: '<string>',
ttl_seconds: 123,
name: '<string>',
require_api_key: false,
tool_kwargs: {}
})
};
fetch('https://api.example.com/api/hooks/trigger-links', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/hooks/trigger-links",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'execution_key' => '<string>',
'topic' => '<string>',
'ttl_seconds' => 123,
'name' => '<string>',
'require_api_key' => false,
'tool_kwargs' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/hooks/trigger-links"
payload := strings.NewReader("{\n \"execution_key\": \"<string>\",\n \"topic\": \"<string>\",\n \"ttl_seconds\": 123,\n \"name\": \"<string>\",\n \"require_api_key\": false,\n \"tool_kwargs\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/hooks/trigger-links")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"execution_key\": \"<string>\",\n \"topic\": \"<string>\",\n \"ttl_seconds\": 123,\n \"name\": \"<string>\",\n \"require_api_key\": false,\n \"tool_kwargs\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/hooks/trigger-links")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"execution_key\": \"<string>\",\n \"topic\": \"<string>\",\n \"ttl_seconds\": 123,\n \"name\": \"<string>\",\n \"require_api_key\": false,\n \"tool_kwargs\": {}\n}"
response = http.request(request)
puts response.read_body{
"data": {
"expires_at": "<string>",
"name": "<string>",
"token": "<string>",
"topic": "<string>",
"trigger_path": "<string>"
}
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Create a trigger link
Mint a trigger link for topic.
ttl_seconds is the creator’s explicit choice (null permanent, positive
timed; 0/negative → 400); a unique name is generated when omitted; a
verifier-bound topic is refused (400); tool_kwargs rides every fire, filling
only the arguments each fired hook’s author left
unpinned. execution_key is the api-key identity the link’s dispatch is gated on,
decided BEFORE the mint so a refusal leaves no live URL. require_api_key makes
the link’s door demand an authenticated caller beside the token. Returns
{"name", "trigger_path", "token", "topic", "expires_at"}
— the token appears ONLY here (nothing else stores or lists it).
created_by is stamped from the AMBIENT caller identity, never a request field
(which would be caller-spoofable); with the gate off there is no principal and it
is stored null.
curl --request POST \
--url https://api.example.com/api/hooks/trigger-links \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"execution_key": "<string>",
"topic": "<string>",
"ttl_seconds": 123,
"name": "<string>",
"require_api_key": false,
"tool_kwargs": {}
}
'import requests
url = "https://api.example.com/api/hooks/trigger-links"
payload = {
"execution_key": "<string>",
"topic": "<string>",
"ttl_seconds": 123,
"name": "<string>",
"require_api_key": False,
"tool_kwargs": {}
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
execution_key: '<string>',
topic: '<string>',
ttl_seconds: 123,
name: '<string>',
require_api_key: false,
tool_kwargs: {}
})
};
fetch('https://api.example.com/api/hooks/trigger-links', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/hooks/trigger-links",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'execution_key' => '<string>',
'topic' => '<string>',
'ttl_seconds' => 123,
'name' => '<string>',
'require_api_key' => false,
'tool_kwargs' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/hooks/trigger-links"
payload := strings.NewReader("{\n \"execution_key\": \"<string>\",\n \"topic\": \"<string>\",\n \"ttl_seconds\": 123,\n \"name\": \"<string>\",\n \"require_api_key\": false,\n \"tool_kwargs\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/hooks/trigger-links")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"execution_key\": \"<string>\",\n \"topic\": \"<string>\",\n \"ttl_seconds\": 123,\n \"name\": \"<string>\",\n \"require_api_key\": false,\n \"tool_kwargs\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/hooks/trigger-links")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"execution_key\": \"<string>\",\n \"topic\": \"<string>\",\n \"ttl_seconds\": 123,\n \"name\": \"<string>\",\n \"require_api_key\": false,\n \"tool_kwargs\": {}\n}"
response = http.request(request)
puts response.read_body{
"data": {
"expires_at": "<string>",
"name": "<string>",
"token": "<string>",
"topic": "<string>",
"trigger_path": "<string>"
}
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Authorizations
Body
Mint a trigger link for a hook topic.
ttl_seconds is REQUIRED (no default ⇒ the key must be present) and STRICT
("3600", 3600.0, 3600.5 and bools all reject under one regime): a
positive int is a timed link, null is a permanent link, and 0/negative
is a loud 400 — expiry is the creator's explicit choice with no default and no
product ceiling. execution_key is the api-key identity the link's dispatch is
gated on — the link dies with the key — and the creator must be allowed to
delegate it; each hook the dispatch reaches still fires as its OWN bound key.
require_api_key makes the link's door demand an authenticated principal ON TOP
of the token — one the authentication backend admits, and, when that principal is
governed by a ROLE, one the ordinary hooks-tag level pass admits at the request's
method (read for GET, write for POST); the governing policy is the OWNER's for
an owned key, so a key escapes that pass exactly when its governing policy is admin or
carries no role pointer. The
default is token-only — the QR-on-a-wall case. topic must be non-empty, the same
rule the stored record enforces, so the mint door never writes a link its own restore
would refuse. tool_kwargs (optional) is stored on the link and merged into every
fired hook's input BELOW that hook's own static tool_kwargs, so it supplies only
the arguments the hook's author left unpinned — a colliding key stays the author's.
Response
Success.
A freshly minted trigger link. token is a ONE-TIME secret — it appears only
here (nothing else stores or lists it); typing must not widen where it is logged.
expires_at is an ISO-8601 timestamp string, or null for a permanent link.
Show child attributes
Show child attributes

