T
Thomas Mueller
We use an AI employee tool that calls the webhook trigger of an account automation, whose step "Send an SMS message to a phone number" alerts the on-call number for urgent guest requests. It works, but:
  • the webhook trigger is protected only by its URL; anyone who knows it can fire the alert
  • the calling tool does not learn whether the SMS was delivered, so the AI cannot tell the guest whether the team was really alerted
  • the rate limits of the trigger and the SMS step are not documented, and an urgent alert must never be dropped by a limit
Request: a signature, header token or IP restriction for webhook triggers; a response that returns the result of the steps (e.g. SMS delivered or failed) to the caller; documented rate limits per account for webhook triggers and the SMS step.
Impact: secure, verifiable alerts triggered from AI employees or any external system.