Webhooks - Cargo | GTM Infrastructure for AI Agents

Cargo webhooks are signed HTTP callbacks. Cargo POSTs JSON to a URL you control when a batch finishes, when a monitored tool fails, or when an external system pushes an event into a model.

Batch and tool completion

When you create a tool batch you may pass webhookUrl and, optionally, webhookSecret:

curl -X POST "https://api.getcargo.io/v1/tools/{tool_id}/batches?token={your_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "webhookUrl": "https://your-server.com/cargo-callback",
    "webhookSecret": "your-secret",
    "data": [
      {"company_domain": "acme.com"}
    ]
  }'

webhookUrl is optional. When set, results are POSTed there on completion. When webhookSecret is set, Cargo signs every delivery with HMAC-SHA256 in the X-Cargo-Signature header (sha256=<hex>). Verify the signature before trusting a delivery:

import { createHmac, timingSafeEqual } from "node:crypto";

function isValidSignature(rawBody: string, secret: string, header: string) {
  const expected =
    "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

See Triggering a tool for the rest of the batch API.

Incoming HTTP listeners

The HTTP integration can listen for webhooks from an external system. Cargo issues a unique URL; a POST to that URL inserts or updates rows on a model and can enrol them in a play. See HTTP integration.

Monitoring

Alerts and tool monitors can POST to your own systems on failure. See Monitoring a tool.

​Batch and tool completion

​Incoming HTTP listeners

​Monitoring

Batch and tool completion

Incoming HTTP listeners

Monitoring