Approve the destination. Claude
records the result.

Create a draft webhook automation, validate its domain and exported fields, publish it as a human admin, then run it over an explicit lead scope and inspect each result.

Automations · reviewed webhook delivery

Domain and field policy · admin publication · inspectable results
illustrative synthetic automation resultsbounded run
just now
1
Synthetic lead example 01selected bounded run
POST approved webhook fields
delivering…
2m ago
2
Synthetic lead example 02selected bounded run
POST approved webhook fields
200 · sent
8m ago
3
Synthetic lead example 03selected bounded run
POST approved webhook fields
200 · delivered
14m ago
4
Synthetic lead example 04selected bounded run
POST approved webhook fields
200 · delivered
23m ago
5
Synthetic lead example 05selected bounded run
POST approved webhook fields
422 · inspect
Example rows only · no customer dataInspect actual results in dashboard, API, or CLI

Who can do what.

The same server role gates apply to dashboard and API callers. Machine keys map to organization member, never admin.

ActorCreate draftValidatePublishRunInspect resultsDelete
Machine org member
Human org member
Human org admin

How a new automation goes live.

An agent or human drafts. A human admin publishes. The server enforces the configured destination and field policy for each explicit run.

Machine

Agent drafts

The agent proposes a webhook URL, lead scope, and exported fields. The draft remains inactive until reviewed.

System

Allowlist check

Coil validates the webhook domain and confirms only allowed fields will leave. Missing keys or unknown domains fail closed.

Human admin

One-time approval

You see the exact payload shape and destination before “publish.” This sign-off happens once per automation.

System

Live + audited

An explicit bounded run creates per-lead results with downstream status and safe evidence metadata.

“What if the agent does something dumb?”

The exact question the next four answers exist for.

Can the agent enable an automation without me?

No. API-key callers are organization members and cannot publish or delete automations. A human organization admin reviews and publishes the exact draft.

What if my webhook is down?

The automation result records the downstream status and safe response metadata. Inspect the failed result before deciding whether to run the bounded action again.

How do I see what's fired?

Use the dashboard, API, or JSON CLI to list automation runs and results. Results are organization-scoped and include delivery status plus available evidence links.

What triggers are supported?

Current automations are explicit webhook actions over selected leads or a bounded lead scope. Coil does not currently claim automatic funding, hiring, reply, bounce, or calendar signal detection.

Webhook delivery with a review boundary.

Draft and validate the automation, publish as a human admin, then run an explicit lead scope and inspect the results.

Automations

Organization-scoped · policy-checked · result evidence