Inputs
The trigger generates a webhook URL when you add it to a workflow. You configure the external system, not the trigger itself. There are no fields to map.Outputs
The trigger exposes two things: the raw request body and the time the request arrived. Request headers are not available as outputs. As a result, you cannot read authentication tokens or custom headers in later blocks.
Reference the raw body in a later block as
{{ steps.webhook_received.body }} and the arrival time as {{ steps.webhook_received.timestamp }}.
Behavior
The trigger fires once for each incoming HTTP request that reaches the webhook URL. Attio passes the request body through as raw JSON text. It does not parse the payload, check that the fields are correct, or change a value from one type to another. Every field arrives exactly as the sender wrote it. A request without theContent-Type: application/json header does not produce a usable run. Treat the payload as untrusted, which means you cannot assume the sender got it right. A sending system can leave out an optional field, send a number where you expected text, or change the shape of its data without warning. The body is raw text, so later blocks see no structure until you parse it.
Gotchas
- Fields read as empty until you parse the body. The trigger output is raw JSON text, not structured data. A mapping such as
{{ steps.webhook_received.email }}resolves to nothing. Follow the trigger with Parse JSON, then map fields from the parsed result. - The request silently does nothing without the JSON content type. A sender that posts form-encoded data, or that omits the
Content-Type: application/jsonheader, will not produce a usable payload. Set the header on the sending system before testing. - A malformed or unexpected payload corrupts records downstream. External systems change their schema without notice. A missing or wrong-typed field can write blank or incorrect values. Validate the parsed payload with a Filter before any block that creates or updates a record.
- Authentication headers are invisible to the workflow. The trigger exposes only the body and a timestamp. You cannot verify a signature or bearer token from a request header. Carry any shared secret inside the JSON body and check it with a Filter.
Examples
Capturing a product signup
A product backend posts a signup event to the webhook URL whenever a new account is created.{{ steps.webhook_received.body }}. From there, Parse JSON exposes email, full_name, and company_domain.
Routing a partner lead with a shared secret
A referral partner posts a lead and includes a shared secret in the body. The workflow uses that secret to confirm the source before writing anything.secret to equal hta-partner-2026. That filter blocks any request that lacks the value. Only verified leads reach the Create or update record block.