---
title: "Automations"
description: "Run agent prompts on webhooks and schedules"
canonical_url: "https://hoplite.sh/docs/automations"
markdown_url: "https://hoplite.sh/docs/automations.md"
---

# Automations
URL: /docs/automations
LLM index: /llms.txt
Description: Run agent prompts on webhooks and schedules
Related: /docs/integrations/slack, /docs/integrations/linear, /docs/threads

# Automations

Automations run an agent prompt against a project without anyone typing it — triggered by an incoming webhook or on a schedule. Use them for recurring chores (dependency bumps, triage sweeps, report generation) or to wire external systems into Hoplite.

Each automation belongs to a project and has a **name**, an **enabled** toggle, a **prompt** (what the agent should do, written exactly like a thread message), an optional title for the runs it creates, and a **trigger**.

## Webhook triggers

A webhook automation reveals a bearer token once. Send it to the fixed
delivery endpoint in the `Authorization` header:

```bash
curl -X POST https://api.hoplite.sh/api/automations/webhooks \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"event":"deploy.failed"}'
```

- An authenticated `POST` runs the automation's prompt as a new agent run
- The token is scoped to that one automation — it can't read data or trigger anything else
- **Rotate** the token any time from the automation's page; the old credential stops working immediately
- Legacy `hwa_` token-in-path URLs remain available during the compatibility window. New and rotated `hwa2_` credentials are header-only and are rejected in URL paths.
- The legacy route can be removed after the bounded `automation` webhook metric reports no `legacy_path` deliveries for 90 consecutive days

## Schedule triggers

Scheduled automations run on either:

- **Cron** — a standard 5-field cron expression with an IANA timezone (e.g. `0 9 * * 1` in `Europe/Dublin` for Mondays at 9:00)
- **Interval** — a fixed period, minimum 1 minute

The automations page shows each automation's last run, its status, and when it fires next.

## What a trigger does

Every trigger does the same thing: starts a new agent run in the project with the automation's prompt. The run behaves like any other — full [sandbox](/docs/sandboxes), full [tool catalog](/docs/agent/tools), visible in your thread list with the complete activity timeline.

<Callout type="tip" title="Write prompts like standing orders">
The prompt runs unattended, so spell out the goal, the constraints, and what "done" looks like — e.g. "Check for outdated dependencies with known CVEs. If any exist, upgrade them, run the test suite, and open a draft PR summarizing the changes. If tests fail, stop and report instead of forcing the upgrade."
</Callout>

## Sitemap

See the full [sitemap](/docs/sitemap.md) for all pages.
Well-known sitemap: [/docs/.well-known/sitemap.md](/docs/.well-known/sitemap.md).