Receive a signed provider webhook (GitHub / Stripe / Slack)
POST/webhooks/:provider
Receiver for a signed provider. The raw request body is read and the provider's signature is verified before any parsing (a re-serialize would break the HMAC).
- Verification is mandatory. A missing, malformed, or failing signature returns 401 and the payload is NOT persisted — only a redacted rejection is logged (ADR-0003).
- On success the event is normalized, persisted (
verified=true,trust_mode=signed), broadcast over SSE, and exposed to the MCP tools. - Signature comparison is constant-time; Stripe/Slack additionally enforce a timestamp freshness window (default 300s) to blunt replay.
Provider-specific handshakes: Slack url_verification returns 200 echoing the
challenge value instead of persisting an event.
Request
Responses
- 200
- 202
- 400
- 401
- 403
- 404
- 413
Provider handshake handled (e.g. Slack url_verification challenge echo).
Verified and persisted.
Malformed request (unreadable body, missing required headers).
Signature missing, malformed, or failed verification. Payload not persisted.
Provider is configured but disabled.
Unknown/unconfigured provider slug.
Body exceeds the configured maximum size.