Intake: webhooks, watched endpoints and rules

Intake turns things that happen elsewhere into tasks: a form is submitted, an order comes in, an email arrives. Something brings a request in (a webhook, a watched API endpoint or a connector trigger), and your rules decide whether it becomes a task, what the task says and who gets it. Company admins set Intake up; everyone in the company can see it.

Intake has three tabs: Rules, Webhooks and sources and Recent requests. Making a webhook, watching something, rotating an address, turning a trigger on and deleting each ask you to confirm it's you.

Webhooks

A webhook is a private address that an app, a form or a script calls to start agent work. On Webhooks and sources, select New webhook, give it a Name and choose How requests prove where they’re from:

• Signed (HMAC-SHA256): the app signs each request with a shared secret, in a header you name, as GitHub and Shopify do. Set the Signature header and Signature encoding, and optionally a Delivery id header so retried deliveries aren't counted twice.
• Standard Webhooks: for apps that follow the Standard Webhooks scheme (Svix included).
• URL only: for apps that can't sign requests. Anyone with the URL can create tasks, so use a signed method when the sending app supports it.

Leave the Signing secret (optional) empty to have one made for you, or paste the one the sending app gave you. Select Make webhook, then copy the URL and secret straight away: Everdeck shows them only this once. A signed webhook also gets a test command you can run to send a signed request.

If you lose the URL or think it leaked, select Rotate: the old address stops working and the new one is shown once. Turn off stops the address; what it received stays under Recent requests.

Watched endpoints

To check an API for new items on a schedule, connect the HTTP request connector, then select Watch an API endpoint: choose the Connection, the Path to check, Where the list is in the answer and the Field that identifies each item. Everdeck checks it regularly and passes on each new item once.

Connector triggers

Many apps can start work through Intake once they're connected: a new email in Gmail, a new lead, a new order. Each app's setup guide lists the triggers it offers today and how to set each one up.

• Under Connector triggers, triggers Everdeck checks for on a schedule have Start watching. Some ask for settings first; Change settings edits them later.
• Under Connections without an address yet, triggers the app sends to an address have Get its URL. Copy the address into the app as its setup guide says: Everdeck shows it only once.

Rules

Requests become tasks only through rules. Without a rule, requests are kept under Recent requests and nothing runs. On the Rules tab, select New rule:

• Name, the Trigger it listens to, and This rule is on.
• When: conditions on the request (Add a condition). For a webhook, check method, content_type, headers.<name>, query.<name> or body.<field>, like body.amount is more than 1000. For a connector trigger, check item.<field>. All conditions must hold. Headers and query parameters that carry a password or token can't be checked, because Everdeck never keeps them.
• Create a task: its Title, Description and Acceptance criteria, which can include parts of the request, like Order {{ body.order_id }}; its Priority, Due after (hours, optional) and Labels (separated by commas); whether The result needs review; and whether to Add the request to the description.
• Assign to and Reviewer: the person or agent who gets the task, and who reviews its result.
• One task per (optional): a key like order-{{ body.order_id }}. Requests with the same key add to the open task instead of making another.
• Keep checking later rules: let later rules match the same request too.

Use Preview with a recent request to check what a rule would make before you save it, then select Add rule.

Rules are checked in order, which you change with Move up and Move down. The first rule that matches creates the task, unless it keeps checking later rules.

What a request contains comes from outside your company. Agents read it as information, never as instructions, and their riskier actions in that session need approval.

Recent requests

Recent requests lists what arrived in the last 30 days: when, from which trigger, what happened (Task created, No matching rule, Waiting, Throttled or Failed) and the tasks it made. Select Details to see the request, or Replay to run it through your rules again after changing them.

Size limits

• A request to a webhook can be up to 1 MB. A URL only webhook takes up to 256 KB, because anyone with its address can call it. Larger requests are refused.
• A form-encoded request (application/x-www-form-urlencoded) can have up to 1,000 fields. One with more is refused, and the sending app is told why.
• All of a company's webhooks together, connector triggers' addresses included, can store 25 MB of requests an hour and 100 MB a day (the day runs in UTC). What counts is what Everdeck stores of each new request (its body, headers and query), plus a little for each one, so empty requests count too. A repeat of a request already received counts nothing.
• The requests they keep, each for 30 days, can take up 2 GB in all.

Past the hour's, the day's or the stored amount, Everdeck turns new requests away and tells the sending app to try again later. Nothing is stored. The hour's and the day's amounts start again when the hour or the day turns, and the 2 GB frees up as requests older than 30 days are removed. Intake shows a notice saying which limit was reached, and Webhooks and sources shows how much is used.

What Everdeck never keeps

Headers and query parameters can carry passwords, tokens and signatures. Everdeck never keeps those with a request, never shows them in its Details, and no rule can check them. That's any header or query parameter:

• named authorization, code, cookie, key, otp, password, paypal-transmission-sig, proxy-authorization, secret, set-cookie, sig, signature, svix-signature, webhook-signature, x-everdeck-token, x-shopify-hmac-sha256 and x-trello-webhook, or starting with x-hub-signature;
• with one of these words in its name: accesskey, apikey, appkey, auth, authkey, authorization, bearer, clientkey, cookie, credential, credentials, hmac, jwt, oauth, otp, passphrase, passwd, password, privatekey, secret, secretkey, sessionkey, sig, signature, signingkey and token;
• with a word in its name that starts with hmac or ends in token, secret or password, like csrftoken;
• with the word key or keys in its name, like X-Api-Key or private_key, unless the word just before it is cache, dedupe, delivery, event, foreign, idempotency, issue, item, lookup, message, object, order, partition, primary, project, public, record, request, routing, row or sort, as in Idempotency-Key or order_key;
• named in a signed webhook's Signature header.

A name's words are split at hyphens, underscores, dots and capital letters, and count only whole: names like keyword, author or session_id are kept.