# Triggers

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/http-api/triggers/
> Summary: The triggers endpoints of the Tracon HTTP API — 5 operations.

5 operations. `{prefix}` is the route prefix passed to
`MapTracon`; the template uses `/tracon`.

## GET {prefix}/api/triggers

**Operation ID:** `TraconListInboundTriggers`

**Lists a tenant's inbound triggers.**

The response carries no signing secret value, only the configuration key's NAME and whether it currently resolves ('resolved') — the diagnosis path for 'I set the secret but signatures still fail'.

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `PlatformRead` API-key scope.

| Response | Body | Headers |
|---|---|---|
| **200** OK | `application/json` → array of [`InboundTriggerResponse`](/http-api/schemas/inboundtriggerresponse/) | — |

## GET {prefix}/api/triggers/{name}

**Operation ID:** `TraconGetInboundTrigger`

**Gets a single inbound trigger.**

An unknown name returns 404.

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `PlatformRead` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `name` | path | yes | `string` | — |

| Response | Body | Headers |
|---|---|---|
| **200** OK | `application/json` → [`InboundTriggerResponse`](/http-api/schemas/inboundtriggerresponse/) | — |

## PUT {prefix}/api/triggers/{name}

**Operation ID:** `TraconSaveInboundTrigger`

**Creates or updates an inbound trigger.**

'signingSecretConfigurationName' carries only the configuration key's NAME, never its value; the name must be under the configured allowed prefix and inside the tenant's own key space — '{prefix}{tenantId}:...'; a flat name directly under the prefix belongs to the default tenant (400 otherwise). 'payloadPath' is required when 'payloadMode' is 'path'.

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `PlatformAdmin` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `name` | path | yes | `string` | — |

**Request body** (required):

- `application/json` → [`InboundTriggerSaveRequest`](/http-api/schemas/inboundtriggersaverequest/)

| Response | Body | Headers |
|---|---|---|
| **200** OK | `application/json` → [`InboundTriggerResponse`](/http-api/schemas/inboundtriggerresponse/) | — |

## DELETE {prefix}/api/triggers/{name}

**Operation ID:** `TraconDeleteInboundTrigger`

**Deletes an inbound trigger.**

After deletion, the accept endpoint returns 404 for this name. An unknown name returns 404.

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `PlatformAdmin` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `name` | path | yes | `string` | — |

| Response | Body | Headers |
|---|---|---|
| **204** No Content | — | — |

## POST {prefix}/api/triggers/{tenantId}/{name}

**Operation ID:** `TraconAcceptInboundTrigger`

**Accepts a signed external event and queues a run.**

No bearer token: the caller authenticates with an HMAC signature over the raw body ('X-Tracon-Timestamp' + 'X-Tracon-Signature', the same headers outbound webhooks send, in the reverse direction). The event is ALWAYS queued and this ALWAYS returns 202 — there is no synchronous mode; a long model call would otherwise fail the caller's own webhook timeout. A missing or wrong signature, an unknown trigger, and a disabled trigger all return the SAME generic response so a caller cannot enumerate trigger names. If a registered IRunAuthorizationHandler denies the target run, the response is 403, before the quota check.

**Authorization:** anonymous.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `tenantId` | path | yes | `string` | — |
| `name` | path | yes | `string` | — |

| Response | Body | Headers |
|---|---|---|
| **202** Accepted | `application/json` → [`InboundTriggerAcceptedResponse`](/http-api/schemas/inboundtriggeracceptedresponse/) | — |
| **400** Bad Request | `application/problem+json` → [`ProblemDetails`](/http-api/schemas/problemdetails/) | — |
| **401** Unauthorized | `application/problem+json` → [`ProblemDetails`](/http-api/schemas/problemdetails/) | — |
| **403** Forbidden | `application/problem+json` → [`ProblemDetails`](/http-api/schemas/problemdetails/) | — |
| **409** Conflict | `application/problem+json` → [`ProblemDetails`](/http-api/schemas/problemdetails/) | — |
| **413** Payload Too Large | `application/problem+json` → [`ProblemDetails`](/http-api/schemas/problemdetails/) | — |
| **429** Too Many Requests | `application/problem+json` → [`ProblemDetails`](/http-api/schemas/problemdetails/) | — |