HackerOne Trigger icon

HackerOne Trigger

Receive HackerOne webhook events in real-time

HackerOne Trigger

AI-generated

Summary

Listen for HackerOne webhook events, optionally filtering by specific event types and verifying incoming requests using an HMAC webhook secret.

Inputs

  • Webhook Secret — The HMAC secret key configured in your HackerOne webhook settings, used to verify the X-H1-Signature header on incoming requests to ensure authenticity.
  • Events (required) — The list of HackerOne event types to listen for. If left empty, the node receives all event types. Events include report lifecycle changes, comments, membership, assignments, and others as defined by HackerOne.

Output shape

a single output stream emitting JSON objects representing incoming webhook events.

Each emitted JSON object includes event metadata extracted from HTTP headers (event name, delivery ID, timestamp) plus the full webhook payload. Incoming requests with an invalid HMAC signature are rejected with a 'Signature mismatch' response. Events not in the selected list are acknowledged but do not produce output.

Links

Discussion