Deel Webhooks WebhookTrigger

Deel Webhooks WebhookTrigger
Certified
Deel Webhook Trigger

Accept incoming Deel webhook requests and trigger on verified events. Each request is verified using HMAC-SHA256 over the documented message (the POST method concatenated with the raw request body) with the webhook signing key, using constant-time comparison. Requests with missing or invalid signatures are rejected without triggering a flow. Only the exact raw body is ever verified, never reserialized JSON: when Kestra delivers an already-parsed body (JSON payloads), the raw bytes are unrecoverable and the request is rejected. Uses Kestra's webhook trigger infrastructure (AbstractWebhookTrigger).

yaml
type: io.kestra.plugin.deel.webhooks.WebhookTrigger

Examples

Trigger on Deel contract events

yaml
id: deel_webhook_events
namespace: company.team
tasks:
  - id: log
    type: io.kestra.plugin.core.log.Log
    message: "Deel event {{ trigger.event }}: {{ trigger.payload }}"
triggers:
  - id: deel_webhook
    type: io.kestra.plugin.deel.webhooks.WebhookTrigger
    key: "deel-webhook"
    secretSigningKey: "{{ secret('DEEL_WEBHOOK_SIGNING_KEY') }}"
    events:
      - contract.created
      - contract.signed

Installation

Our standard Docker images already include this plugin. If you use a -slim image or another setup, install it with the following command:

kestractl plugins get io.kestra.plugin:plugin-deel --compatible-for $KESTRA_VERSION

For kestractl, use your Kestra version with --compatible-for, or specify an exact plugin version.

For Kestra CLI, replace LATEST with a specific version or version range to pin the plugin version.

Properties

key *string

Min length1

Max length256

The unique key that will be part of the URL.

The key is used for generating the webhook URL.

::alert{type="warning"} Make sure to keep the webhook key secure. It's the only security mechanism to protect your endpoint from bad actors, and must be considered as a secret. You can use a random key generator to create the key. ::

secretSigningKey *string

Webhook signing key

Signing key of the Deel webhook subscription (returned when the subscription is created). Used as UTF-8 bytes for HMAC-SHA256 verification, matching the official Deel examples.

allowConcurrent boolean

Defaultfalse

Specifies whether a trigger is allowed to start a new execution even if a previous run is still in progress.

events array

SubTypestring

Events to trigger on

Optional exact-match filter on the webhook event type (e.g., contract.created). When empty, every verified webhook triggers an execution.

fetchType string

DefaultFETCH

Possible Values

NONEFETCHSTORE

What the trigger does with the body of the webhook request.

FETCH: the body reaches the flow on the body output. A JSON body is deserialized, a binary one is base64-encoded. This is the default, and how a webhook has always behaved.
STORE: the body is streamed into Kestra's internal storage as it is received, and the flow reaches it through the uri output. Nothing of it travels through the execution, so this is the option to use for a large or binary payload - but note that a condition on the trigger can no longer read the body.
NONE: the body is read off the connection and dropped. Use it for a caller whose payload the flow does not need.

This only concerns the body of a request. The file parts of a multipart/form-data request are always stored in the internal storage and exposed on parts, whatever this property is set to, as a file part has no meaningful representation inside an execution.

inputs object

The inputs to pass to the triggered flow

stopAfter array

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

List of execution states after which a trigger should be stopped (a.k.a. disabled).

when string

Defaulttrue

A condition that determines whether the trigger should run.

A Pebble expression evaluated at trigger time. The trigger fires only when the expression evaluates to a truthy value (true, a non-empty string, a non-zero number). Use this to gate trigger execution on dynamic runtime values such as execution labels, flow variables, or environment conditions.

Outputs

event string

Event type

The verified Deel webhook event type (e.g., contract.created).

payload object

Payload

The original verified webhook payload (meta, resource, timestamp).