tai hooks create-trigger-link
Mint a trigger link — a PUBLIC URL that fires the topic’s hooks.
--execution-key is REQUIRED: the api-key identity the link’s DISPATCH is gated on,
so revoking or disabling that key kills the link (each hook the link fires is
authorized against its OWN bound key). Bind your own identity when you are an api key,
or a key you own (an admin may bind any key); an account is refused. Its policy
condition must be evaluable without a presented token.
Exactly ONE of --ttl SECONDS or --permanent is required — expiry is an explicit
choice. --require-api-key also demands an authenticated caller, enforced only where
access control is ENABLED; it does not touch the topic’s own
/universal_webhook/{topic} door, which stays public by its own route declaration —
a verifier binding is its only lock. --params merges BELOW each fired
hook’s static tool_kwargs, so a link never restates a pinned argument. The token is
shown ONCE, in the printed absolute URL; the link is MULTI-use and revocable by name
(tai hooks delete-trigger-link NAME). Regenerate = revoke + create.
Example: tai hooks create-trigger-link events --execution-key svc --ttl 3600 --params '{"p":"hi"}'
tai hooks delete
Unregister a hook by name.
Example: tai hooks delete h1
tai hooks delete-trigger-link
Revoke a trigger link by name.
The revocation is immediate and durable: a restored backup cannot re-arm it.
Example: tai hooks delete-trigger-link my-wall-qr
tai hooks delete-verifier
Remove a topic’s verifier binding.
ADMIN-ONLY: a hooks-write role is fenced out of this door and reads a bare 403.
Unbinding REOPENS the topic’s public /universal_webhook/{topic} ingress door to
anyone who knows the topic name, at which point every hook on it fires under its bound
execution key for an anonymous caller.
Example: tai hooks delete-verifier github
tai hooks list
List registered hooks.
The per-topic verifier bindings and each topic’s derived trigger_auth ride the --json body.
Example: tai hooks list --topic github
tai hooks register
Register a hook from a HookRegister JSON body.
Exactly one of --params or --params-file is required.
The body REQUIRES an execution_key — the api-key user id the hook fires as. Bind
your own identity when you are an api key, or a key you own (an admin may bind any
key); an account is refused. Its policy condition must be evaluable without a
presented token.
An existing name is REPLACED, execution_key included, and registered is
true either way — run tai hooks list first to see whether the name is taken.
A hook is a parkable-driving door: an optional start_expr builds the fired tool’s
kwargs over the event payload (e.g. "start_expr":".body"), and cancel_expr /
resume_expr / extras_expr act on the run’s parked interactions and its extras.
Example: tai hooks register --params '{"name":"h1","topic":"gh","tool":"notify","execution_key":"svc"}'
tai hooks runs
List, retry or discard hook runs.
tai hooks runs discard
Discard a failed hook run for good.
Example: tai hooks runs discard RUN_ID --yes
tai hooks runs list
List the kept hook runs, never their payloads; --json adds the outstanding and failed totals.
The acted column says whether the hook had acted when the run failed: start (a
retry replays the tool’s start), "" or cancel (a retry runs the hook again), or
resume or take (it can only be discarded).
Example: tai hooks runs list --status failed
tai hooks runs retry
Retry a failed hook run with the same id, and so the same idempotency key.
A run whose hook started its tool replays that start alone; any other runs its hook again.
A run whose hook committed a resume or a take is refused, and the refusal says why.
Example: tai hooks runs retry RUN_ID
tai hooks set-verifier
Bind a webhook verifier to a topic so its deliveries are signature-verified.
ADMIN-ONLY: a hooks-write role is fenced out of this door and reads a bare 403.
Binding also takes every trigger link on the topic OUT OF SERVICE until it is
removed — those doors answer a uniform 404 while the binding stands.
Example: tai hooks set-verifier github --verifier github_hmac
tai hooks trigger-links
List trigger links.
Each record carries name, topic, execution key, door auth, expiry, and hash prefix; never a raw token.
Example: tai hooks trigger-links
tai hooks verifiers
List the registered webhook-verifier names (the bind catalog).
Example: tai hooks verifiers