# Someone is triggering a GET-request flowcard

**URL:** <https://community.homey.app/t/someone-is-triggering-a-get-request-flowcard/82258>\
**Category:** Questions & Help\
**Created:** [June 13, 2023, 11:18am UTC](https://community.homey.app/t/someone-is-triggering-a-get-request-flowcard/82258 "2023-06-13T11:18:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Johan\_Lindbom](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/johan_lindbom/32/3537_2.png) [@Johan\_Lindbom](https://community.homey.app/u/Johan_Lindbom)\
**Post date:** [June 13, 2023, 11:18am UTC](https://community.homey.app/t/someone-is-triggering-a-get-request-flowcard/82258/1 "2023-06-13T11:18:39Z")

</div>

Hi,

I have a flow card that is triggered from a Logic GET-request.  
GET [https://webhook.homey.app/](https://webhook.homey.app/)/?tag=

Whenever a request is made to the URL, a push notification is sent to my mobile. It all works fine.

However, a few days ago, I got a bunch of notifications from the Flow over a few hours in the middle of the night. Then it stopped in the morning. The same thing happend the next night, and the night after that. These events are not triggered by the device the flow is intended to be triggered from, so I believe someone else is triggering my flow.

Using Logic flow card with GET-request as a trigger of a flow, is it possible for anybody to trigger my flow, as long as they know my Homey-ID and endpoint?

Is there any way that I can find out from what IP the flow is triggered? Logs?

Thanks for any help on this! I am confused.

---

<div class="post-metadata">

**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\
**Post date:** [June 13, 2023, 11:37am UTC](https://community.homey.app/t/someone-is-triggering-a-get-request-flowcard/82258/2 "2023-06-13T11:37:03Z")

</div>

> [@Johan\_Lindbom](#):
>
> is it possible for anybody to trigger my flow, as long as they know my Homey-ID and endpoint?

Yes. And since the endpoint _contains_ your Homey ID, they only have to know the URL.

It could be an innocent situation where the URL has somehow leaked and now it’s being indexed by a search engine, for instance.

That’s why it’s common that webhooks only work with `POST` requests, which search engines typically don’t index.

> [@](#):
>
> Is there any way that I can find out from what IP the flow is triggered? Logs?

Not AFAIK.

---

<div class="post-metadata">

**Author:** ![Peter\_Kawa](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/peter_kawa/32/173848_2.png) [@Peter\_Kawa](https://community.homey.app/u/Peter_Kawa)\
**Post date:** [June 13, 2023, 1:53pm UTC](https://community.homey.app/t/someone-is-triggering-a-get-request-flowcard/82258/3 "2023-06-13T13:53:37Z")

</div>

And I think when you use this trigger card

> ![Screenshot_20230613-155804_Homey](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/4/8/482fc66c6b19b0a0c2ec7baca598b57a87739ffc.jpeg)

changing all of your current event and tag descriptions, is the only and easiest way to stop these flows from being triggered.  
You can’t trigger flows without at least a matching event description.

Other option, request a new homeyID;  
But little chance (=assumption) Athom can change or wants to change your homeyID

---

<div class="post-metadata">

**Author:** ![Johan\_Lindbom](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/johan_lindbom/32/3537_2.png) [@Johan\_Lindbom](https://community.homey.app/u/Johan_Lindbom)\
**Post date:** [June 18, 2023, 7:50pm UTC](https://community.homey.app/t/someone-is-triggering-a-get-request-flowcard/82258/4 "2023-06-18T19:50:13Z")

</div>

Thanks for your help on this!

However, in my case, it turned out I was wrong in my first guess of the problem. The URL was not triggered from the Internet. The flow is triggered from my homemade WIFI mousetrap. The glue holding the switch was getting soft in the heat causing the switch to activate.

It is at least good to know that these events can be triggered by anyone that has access to the URL.

---

<div class="post-metadata">

**Author:** ![Peter\_Kawa](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/peter_kawa/32/173848_2.png) [@Peter\_Kawa](https://community.homey.app/u/Peter_Kawa)\
**Post date:** [June 18, 2023, 10:46pm UTC](https://community.homey.app/t/someone-is-triggering-a-get-request-flowcard/82258/5 "2023-06-18T22:46:35Z")

</div>

You’re welcome! That’s something different hehe, glad you found the cause.