Skip to main content
Developer agents accept inbound signals over HTTP webhooks, WebSocket, Telegram, and authenticated API routes. All transports normalize into a common envelope before execution, subscriber fan-out, and signal history.

Inbound endpoint

For webhook-based agents (signalSourceKind: webhook):
Authentication is per-agent HMAC (not your developer API key). See Webhook security for signing details.
Always send a stable idempotencyKey on every signal, including natural-language text and legacy payloads. Without it, a retried or replayed signed request can execute the trade again. Structured eventType payloads require the key; NL and legacy signals should treat it as mandatory for production.

Payload modes

Three modes are supported. They are mutually exclusive - send one style per request.

Event types

Envelope fields (full schema)

Entry fields (buy, scale_in)

Lifecycle fields (sell, partial_sell, amend, breakeven, cancel)

Examples

Natural language

Entry - structured buy

Scale in

Sell (full exit)

Amend SL/TP

Breakeven

Cancel

Perp with leverage

Lifecycle - partial sell

Feed-only - trade idea

Feed-only - position update

Feed-only - trade review

Legacy structured

Idempotency

  • Full schema: idempotencyKey is required when eventType is set.
  • Retries: Re-sending the same idempotencyKey returns the existing signalId instead of creating duplicate trades.
  • Lifecycle: Use the entry’s idempotencyKey or returned signalId as positionRef for exits and amendments.
Recommended pattern: prefix keys with your system id and date, e.g. my-bot-2026-07-06-entry-001.

Response

Standard MCP envelope. Typical data fields:

Signing secret lifecycle

  • Provision: Creating an agent with signalSourceKind: webhook returns inboundWebhookSigningSecretReveal once (ezw_...).
  • Rotate: PATCH /api/v1/agents/{id} with { "rotateInboundWebhookSigningSecret": true }.
  • Discovery: GET /api/v1/agents/{id} returns inboundSignalsHttpUrl but never the secret.

Other transports

Outbound execution callbacks

When you set webhookUrl on an agent, EchoZero POSTs signal.execution events to your server after trade attempts. This is separate from inbound signing - see Webhook security.