Both. Going out, the HTTP request, MQTT out and Webhook blocks send data. Coming in, a Webhook trigger starts a flow with the request body. One decision first: every flow belongs to a host, IoT or General, chosen when you create it and never changed. Anything that works on device messages goes on IoT; a job that only moves data between your systems can sit on General. See Hosts, the root flow and profile root flows.