Triggers
The five ways a workflow starts: live event, pattern, schedule, webhook, and manual.
A trigger decides when a workflow runs and hands it the first input. Every workflow has exactly one.
Live event
Fires on a new matching row as it arrives: an event, an agent run, or a span. You pick the entity, the event name, and filters. Use it to react the moment something happens (a specific event fires, a run errors).
Pattern (threshold)
Fires when a count crosses a threshold over a rolling window, for example "more than 20 errors in 15 minutes" or "10 unique users hit this in an hour". You set the window, the minimum count, an optional unique-user count, and a cooldown so it doesn't fire repeatedly. Use it for spikes and anomalies.
Schedule
Fires on a cron schedule in a timezone you choose (for example every day at 09:00). Use it for digests, nightly reports, and periodic checks.
Webhook
Exposes a public URL that starts the workflow when called. The request is verified with a timing-safe secret, can require an HMAC signature, and de-dupes on an idempotency key. Use it to start a workflow from an external system.
Manual
Run on demand from the editor ("Run now"), or have another workflow call it as a sub-workflow. Use it for testing and for reusable building blocks.
Integration events
Workflows can also start from an integration's events. Slack event ingress is fully wired (for example an app mention starts the workflow).