Return XML from a Webhook Request

Expose a synchronous HTTP webhook in Kestra that accepts a POST request, runs a Python script to build a structured XML document, and returns the serialized XML payload to the caller in the same request. This blueprint shows how to turn a Kestra flow into an on-demand API endpoint that bridges modern orchestration with legacy systems and partners that still consume XML rather than JSON.

How it works

1. The io.kestra.plugin.core.trigger.Webhook trigger publishes a unique URL secured by a webhook key loaded from {{ secret('WEBHOOK_SECRET_KEY') }}. The trigger has wait: true so the HTTP caller is held open until the flow finishes, and returnOutputs: true so the task outputs are returned in the response body.
2. The build_xml task (io.kestra.plugin.scripts.python.Script) uses Python's standard xml.etree.ElementTree to construct a root element with child fields, serializes it to a string, and emits it via Kestra.outputs({"xml": xml_string}).
3. Because the Kestra webhook response is JSON, the XML document is returned as the outputs.build_xml.vars.xml field. Callers read that field and treat it as XML. For pure application/xml responses, front the flow with an API gateway that rewrites the content type.

What you get

• A reusable webhook endpoint backed by a Kestra flow
• XML payload construction in Python with no extra dependencies
• Secret-protected trigger key, with full execution history per call
• A working pattern for legacy integrations, SOAP-style partners, and RSS or sitemap style feeds

Who it's for

• Integration engineers connecting Kestra to XML-only partners or legacy ERPs
• Platform teams exposing internal workflows as lightweight HTTP APIs
• Data teams that need a callable endpoint to return structured snapshots on demand

Why orchestrate this with Kestra

A raw web framework can return XML, but it cannot natively retry the upstream data fetch, version the response logic, replay a failed call, or give you lineage across the pipeline that produced the payload. Kestra adds event-driven webhook triggers, declarative YAML, retries and timeouts on every task, a full execution log per request, and the ability to chain the same logic into scheduled or queue-driven flows. You get an API endpoint plus a fully observable workflow behind it.

Prerequisites

• A running Kestra instance reachable from the caller
• Python available on the worker (default in the standard Kestra image)

Secrets

• WEBHOOK_SECRET_KEY: the webhook key embedded in the trigger URL, used to authorize incoming POST requests.

Quick start

1. Add the WEBHOOK_SECRET_KEY secret in your Kestra instance.
2. Save the flow and copy the generated webhook URL from the trigger.
3. Send a POST request to the URL with any JSON body.
4. Read outputs.build_xml.vars.xml from the response to get the XML document.

How to extend

• Replace the hardcoded data dictionary with values read from {{ trigger.body }} to echo request data back as XML.
• Query a database or REST API in an earlier task and feed the result into the XML builder.
• Swap ElementTree for lxml to emit pretty-printed or namespaced XML, including SOAP envelopes.
• Add a downstream task that stores each response to object storage for audit, or fans out to Kafka, Slack, or email on specific payloads.
• Front the flow with a reverse proxy that rewrites the response content type to application/xml for strict clients.

Links

• Core plugin docs: https://kestra.io/plugins/plugin-core