Power Automate webhook: When an HTTP request is received, HTTP action and limits

To set up a Power Automate webhook, add the When an HTTP request is received trigger to a cloud flow, save the flow, and give the generated URL to your sender; inbound requests time out after 120 seconds. Below: who can call the URL, building the trigger schema from a payload captured in a free bin, limits, licensing, checking what the HTTP action sends, and why HTTP-triggered flows stop firing.

The trigger URL and who can call it

The URL is generated when you save the flow, and its sig= parameter is a Shared Access Signature (SAS) key that works like a password. If the URL leaks, regenerate the key so the old sig= value stops working.

For Who can trigger the flow, new flows default to Any user in my tenant, so callers need an OAuth bearer token from your tenant in the Authorization header, which an outside SaaS sending webhooks usually can't provide. Anyone is the legacy open option with no extra authentication, and it's the option for senders that can't get a token.

Build the trigger schema from a real payload

1. Create a free bin in your browser or with curl -X POST https://webhooks.sh/v1/bins.
2. Set the bin's ingest URL, for example https://<bin>.webhooks.page/flow, as the webhook URL in the sending app, and trigger a real event so a request lands in the bin.
3. Copy the raw JSON body from the bin viewer.
4. In the Power Automate trigger, select Use sample payload to generate schema, paste the JSON body in, and select Done.

The schema now matches what the sender really sends, so later steps get the right dynamic content, and you can replay the saved payload to the flow URL with curl instead of waiting for real events.

# 1. Create a free bin and point the sender at its ingest_url
curl -X POST https://webhooks.sh/v1/bins

# 2. Replay the captured body to the flow's trigger URL
#    (add -H "Authorization: Bearer <token>" unless the
#    trigger is set to Anyone)
curl -X POST "<flow-trigger-url>" \
  -H "Content-Type: application/json" \
  -d @payload.json

Timeouts and size limits

A flow with an HTTP Response action always answers within the 120-second inbound limit, and actions after the response keep running, so respond early when the sender only needs an acknowledgment.

The HTTP action also gets 120 seconds for a synchronous call; for longer jobs Microsoft suggests an asynchronous polling pattern or an Until loop (see the Power Automate limits documentation).

Licensing: premium connectors

Microsoft's child flow documentation lists the Response action as part of the premium HTTP request/response connector. Premium connectors need a standalone license, such as Power Automate Premium at $15.00 per user per month or Power Automate Process at $150.00 per bot per month, both paid yearly, while the free plan and Microsoft 365 plans only include standard connectors. In Microsoft's connector list, a premium connector shows PREMIUM under its name.

See what the HTTP action sends

Point the Power Automate HTTP action at https://<bin>.webhooks.page/flow and run the flow once: the bin shows the method, headers and the body after expressions were filled in, which catches wrong Content-Type headers and broken JSON before you call the real API.

Two limits apply: header values whose names contain authorization, cookie, key, token or secret show as redacted, so you see that an Authorization header arrived but not its value; and the bin always replies 200 with a small JSON body, so it can't stand in for an API whose response later steps parse. To send the same request by hand, see the curl POST guide.

When an HTTP-triggered flow stops firing

• The sender is still calling an old logic.azure.com URL, which stopped working on November 30, 2025; admins can list affected flows by running Get-AdminFlowWithMigratingTriggerUrl.
• The new URL can be longer than 255 characters with SAS authentication, and the sending system has to accept a URL that long.
• Someone regenerated the flow's SAS key, so the sig= value in the sender's URL no longer matches.
• Who can trigger the flow is set to Any user in my tenant or Specific users in my tenant, and the sender isn't passing an Authorization bearer token.
• Nobody triggered the flow for 90 days and Power Automate turned it off (flows owned by a user with a premium license or covered by a Process license aren't turned off this way).
• A trigger input uses an expression like utcNow(), which Power Automate evaluates and fixes at the moment the flow is saved rather than on each run.

Since June 2, 2026, the callback URL includes the scale unit (/direct/cu/20/workflows/... instead of /direct/workflows/...), and the older form keeps working. Teams incoming webhooks are now built with the Workflows app, which runs on Power Automate; see the Microsoft Teams webhooks page, and the webhook not received guide for missing deliveries in general.

Keep the capture URL

A free bin lasts 48 hours and takes 100 requests a day of up to 100KB each, plenty to capture sample payloads and check the HTTP action. To keep the URL, claim the bin with a free Google sign-in before it expires; it then keeps 30 days of rolling history.

Solo ($12 a month) adds named endpoints on webhooks.host with 250,000 requests a month, 90 days of history and forwarding to up to 3 verified HTTPS URLs; see pricing.

FAQ

How do I get the webhook URL in Power Automate?

Add the When an HTTP request is received trigger to a cloud flow and save it. The URL is generated on save and shown on the trigger, with its SAS key in the sig= parameter.

Is the Power Automate HTTP request trigger premium?

Microsoft's docs place the Response action on the premium HTTP request/response connector, and premium connectors need a standalone license such as Power Automate Premium or Process. Free and Microsoft 365 plans only include standard connectors.

What is the Power Automate HTTP request timeout?

The timeout is 120 seconds (2 minutes) for inbound requests to an HTTP-triggered flow, and 120 seconds for outbound synchronous requests made with the HTTP action.

Who can call a Power Automate HTTP trigger URL?

New flows default to Any user in my tenant, which requires the caller to send an OAuth bearer token in the Authorization header. Anyone is the legacy option that lets any caller with the full URL trigger the flow without extra authentication.

Why did my Power Automate HTTP trigger URL stop working?

Old trigger URLs containing logic.azure.com stopped working on November 30, 2025. Otherwise, the flow's SAS key (sig=) may have been regenerated, the flow was turned off after 90 days without triggers, or the trigger is set to a tenant authentication option that requires a bearer token the sender isn't passing.

How do I generate the JSON schema for the HTTP trigger?

In the When an HTTP request is received trigger, select Use sample payload to generate schema, paste in a real JSON payload (for example, one you captured from your sender in a free bin), and select Done.