tai hooks create-trigger-link
Mint a trigger link — a PUBLIC URL that fires the topic’s hooks.
--execution-key is REQUIRED: the api-key identity the link’s DISPATCH is gated on,
so revoking or disabling that key kills the link (each hook the link fires is
authorized against its OWN bound key). Bind your own identity or a key you own (an
admin may bind any); its policy condition must be evaluable without a presented token.
Exactly ONE of --ttl SECONDS or --permanent is required — expiry is an explicit
choice. --require-api-key also demands an authenticated caller, enforced only where
access control is ENABLED; it does not touch the topic’s own
/universal_webhook/{topic} door, which stays reachable by anyone who knows the
topic name wherever the deployment maps it public. --params merges BELOW each fired
hook’s static tool_kwargs, so a link never restates a pinned argument. The token is
shown ONCE, in the printed absolute URL; the link is MULTI-use and revocable by name
(tai hooks delete-trigger-link NAME). Regenerate = revoke + create.
Example: tai hooks create-trigger-link events --execution-key svc --ttl 3600 --params '{"p":"hi"}'
tai hooks delete
Unregister a hook by name.
Example: tai hooks delete h1
tai hooks delete-trigger-link
Revoke a trigger link by name (immediate and durable — a restored backup
cannot re-arm it).
Example: tai hooks delete-trigger-link my-wall-qr
tai hooks delete-verifier
Remove a topic’s verifier binding. ADMIN-ONLY: a hooks-write role is fenced
out of this door and reads a bare 403.
Unbinding REOPENS the topic’s public /universal_webhook/{topic} ingress door to
anyone who knows the topic name, at which point every hook on it fires under its bound
execution key for an anonymous caller.
Example: tai hooks delete-verifier github
tai hooks list
List registered hooks (the per-topic verifier bindings and each topic’s
derived trigger_auth ride the --json body).
Example: tai hooks list --topic github
tai hooks register
Register a hook from a HookRegister JSON body. Exactly one of --params or
--params-file is required.
The body REQUIRES an execution_key — the api-key user id the hook fires as. Bind
your own identity or a key you own (an admin may bind any); its policy condition must
be evaluable without a presented token.
An existing name is REPLACED, execution_key included, and registered is
true either way — run tai hooks list first to see whether the name is taken.
Example: tai hooks register --params '{"name":"h1","topic":"gh","tool":"notify","execution_key":"svc"}'
tai hooks set-verifier
Bind a webhook verifier to a topic so its deliveries are signature-verified.
ADMIN-ONLY: a hooks-write role is fenced out of this door and reads a bare 403.
Binding also takes every trigger link on the topic OUT OF SERVICE until it is
removed — those doors answer a uniform 404 while the binding stands.
Example: tai hooks set-verifier github --verifier github_hmac
tai hooks trigger-links
List trigger links (name, topic, execution key, door auth, expiry, hash
prefix; never a raw token).
Example: tai hooks trigger-links
tai hooks verifiers
List the registered webhook-verifier names (the bind catalog).
Example: tai hooks verifiers