Triggers

Operator registers https://acme.example.com/webhook-test/abc-123 as the callback for a partner API. Partner POSTs after the workflow tab is closed.

/webhook-test/{path} is active only while the workflow is open in the editor with 'Listen for test event' on. Production callbacks must use /webhook/{path} on an ACTIVATED workflow. Update the partner's registered URL to the production path before going live.

Operator sets `0 9 * * 1-5` on a Schedule Trigger and expects 9am New York. The n8n instance runs in UTC.

Cron in the Schedule Trigger evaluates against the instance timezone (GENERIC_TIMEZONE env var) unless overridden on the trigger. Set GENERIC_TIMEZONE=America/New_York or pin the timezone on the trigger explicitly — do not rely on the implicit UTC default for business-hour workflows.

A public-internet webhook URL with `Authentication: None` is registered. The endpoint receives anonymous POSTs from scrapers and a prompt-injection payload lands in a downstream AI Agent node.

Always enable webhook authentication: Header Auth with a long shared secret, Basic Auth, or JWT validation. Even with auth, treat webhook body as untrusted input — sanitise before feeding into downstream LLM / SQL / shell surfaces.