This document describes the dedicated webhook-style HTTP trigger surface for MicroClaw automation.
This feature is for external systems (webhooks, CI, cron scripts) that need to trigger agent runs without Web UI interaction.
POST /hooks/agentPOST /api/hooks/agent(alias)POST /hooks/wakePOST /api/hooks/wake(alias)
/hooks/* endpoints use a dedicated token from channels.web.hooks_token.
Supported headers:
Authorization: Bearer <token>(recommended)x-openclaw-token: <token>x-microclaw-hook-token: <token>
If hooks_token is missing, the endpoint returns 503.
channels:
web:
hooks_token: "replace-with-secret"
hooks_default_session_key: "hook:ingress"
hooks_allow_request_session_key: false
hooks_allowed_session_key_prefixes: ["hook:"]- By default, request
sessionKeyis rejected (hooks_allow_request_session_key: false). - If enabled, values can still be restricted by
hooks_allowed_session_key_prefixes. - When no request
sessionKeyis provided,hooks_default_session_keyis used.
OpenClaw-style payload compatibility:
{
"message": "Summarize inbox",
"name": "Email",
"sessionKey": "hook:email:msg-123"
}Fields:
messagerequired.nameoptional (used as sender fallback).sessionKeyoptional; subject to session key policy.
Response:
200with async run payload (run_id), then consume/api/stream.
Payload:
{
"text": "New email received",
"mode": "now"
}Fields:
textrequired.modeoptional:now(default) ornext-heartbeat.
Behavior:
now: starts an async run immediately (returnsrun_id).next-heartbeat: only queues a system event message in the hook session and returns queue metadata.
curl -sS http://127.0.0.1:10961/hooks/agent \
-H "Authorization: Bearer $MICROCLAW_HOOKS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"message":"Summarize inbox","name":"Email"}'curl -sS http://127.0.0.1:10961/hooks/wake \
-H "Authorization: Bearer $MICROCLAW_HOOKS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"text":"New email received","mode":"next-heartbeat"}'401 unauthorized: missing or invalid hook token.400 sessionKey override is disabled: request tried to setsessionKeywhile overrides are disabled.400 sessionKey is not allowed by configured prefixes: requestsessionKeyfailed prefix policy.503 hooks token is not configured: setchannels.web.hooks_tokenand restart.