Skip to main content
A trigger gives an agent a public URL. Call that URL and the agent starts working. There is no SDK, no key exchange and no handshake: anything that can send an HTTP request can fire an agent.
Create a trigger in the app under the agent Triggers tab, or with upsert_trigger. Both give you the full URL.

​
The URL is the credential

There is no signature, no secret header and no allowlist. Whoever holds the URL can fire the agent, as many times as they want.
Treat every trigger URL like a password. Do not paste it into a shared document, a ticket or a public repository. If one leaks, rotate it with rotate_trigger_token or from the Triggers tab, and update every service configured with it.
Because the URL is the whole authentication, Rerun cannot validate a third-party signature header today. Caller headers are never forwarded to the agent: they carry credentials and are trivially spoofed.

​
Methods

A trigger declares which HTTP methods it accepts. The default is POST alone. GET, POST, PUT, PATCH and DELETE all reach the same handler. HEAD and OPTIONS never start a run.
Accepting GET means a link preview, a prefetch or a crawler could fire your agent by touching the URL. Rerun filters the known ones, but keep POST unless the calling service cannot send it.

​
What the agent receives

The agent gets the trigger body, which is the instruction you wrote, followed by the caller payload in a <trigger_payload> block:
JSON is pretty-printed. The payload is truncated at 64 KB. Any closing tag inside the payload is escaped, so a caller cannot inject instructions by ending the block early. Each call opens a new session named trigger: <slug>. Two calls are always two runs: nothing is collapsed or debounced.

​
Response codes

The call returns as soon as the run has started. It does not wait for the agent to finish. That last row is deliberate. A malformed slug, a missing token, an unknown agent, a wrong token, a disabled trigger and an engine that turned the call away all answer 404, so nobody can probe which triggers exist on your account.

​
Passive visits

Link unfurlers, prefetchers and clipboard managers touch URLs without anyone clicking them. Rerun answers those with 204 and never starts a run. The filter covers Slack, Discord, Twitter, WhatsApp, Raycast and other known agents, plus any request carrying a prefetch or preview intent header. Pasting a trigger URL into a chat is still a leak, but it will not fire your agent by itself.

​
Limits

​
Testing

Fire it yourself with curl:
Or use test_trigger, which pre-checks the method and the enabled state so you get a readable error instead of a bare 404. Either way it is a real fire: it counts towards the trigger fire count. Read the outcome with get_run, using the runId from the 202.