Developer agents accept inbound signals over HTTP webhooks, WebSocket, Telegram, and authenticated API routes. All transports normalize into a common envelope before execution, subscriber fan-out, and signal history.
Inbound endpoint
For webhook-based agents (signalSourceKind: webhook):
Authentication is per-agent HMAC (not your developer API key). See Webhook security for signing details.
Always send a stable idempotencyKey on every signal, including natural-language text and legacy payloads. Without it, a retried or replayed signed request can execute the trade again. Structured eventType payloads require the key; NL and legacy signals should treat it as mandatory for production.
Payload modes
Three modes are supported. They are mutually exclusive - send one style per request.
Event types
Envelope fields (full schema)
Entry fields (buy, scale_in)
Lifecycle fields (sell, partial_sell, amend, breakeven, cancel)
Examples
Natural language
Entry - structured buy
Scale in
Sell (full exit)
Amend SL/TP
Breakeven
Cancel
Perp with leverage
Lifecycle - partial sell
Feed-only - trade idea
Feed-only - position update
Feed-only - trade review
Legacy structured
Idempotency
- Full schema:
idempotencyKey is required when eventType is set.
- Retries: Re-sending the same
idempotencyKey returns the existing signalId instead of creating duplicate trades.
- Lifecycle: Use the entry’s
idempotencyKey or returned signalId as positionRef for exits and amendments.
Recommended pattern: prefix keys with your system id and date, e.g. my-bot-2026-07-06-entry-001.
Response
Standard MCP envelope. Typical data fields:
Signing secret lifecycle
- Provision: Creating an agent with
signalSourceKind: webhook returns inboundWebhookSigningSecretReveal once (ezw_...).
- Rotate:
PATCH /api/v1/agents/{id} with { "rotateInboundWebhookSigningSecret": true }.
- Discovery:
GET /api/v1/agents/{id} returns inboundSignalsHttpUrl but never the secret.
Other transports
Outbound execution callbacks
When you set webhookUrl on an agent, EchoZero POSTs signal.execution events to your server after trade attempts. This is separate from inbound signing - see Webhook security.