Receive inbound webhook payload

Receives a JSON payload for a tenant inbound webhook. Authentication, idempotency, rate limit, and handler behavior are controlled by the webhook configuration.

RBAC · inbound_webhook

Path parameters

tenantSlugstringRequired

URL-safe tenant slug used for inbound webhook routing.

webhookSlugstringRequired

URL-safe inbound webhook slug unique within the tenant.

Header parameters

content-typestringOptional

Expected to be application/json for JSON payloads.

x-signaturestringOptional

Example HMAC-SHA256 signature header. Actual header name is webhook-configurable.

x-idempotency-keystringOptional

Optional idempotency key header when the webhook uses a header idempotency source.

Request body

Content type: application/json

any

Response body

Success response 200

delivery_idstring <uuid>Required

Response codes

200

Request accepted or treated as duplicate no-op.

400

Invalid request payload or handler validation failure.

401

Authentication failed or receiver is unknown/inactive. Response body is intentionally empty to avoid leaking which webhooks exist.

429

Per-webhook rate limit exceeded.

500

Unexpected dispatch failure.

POST /api/inbound/{tenantSlug}/{webhookSlug}

cURL

curl -X POST "https://algapsa.com/api/inbound/{tenantSlug}/{webhookSlug}" \
  -H "X-API-Key: $ALGA_API_KEY" \
  -H "content-type: string" \
  -H "x-signature: string" \
  -H "x-idempotency-key: string" \
  -H "Content-Type: application/json" \
  -d 'null'

TypeScript

const response = await fetch("https://algapsa.com/api/inbound/{tenantSlug}/{webhookSlug}", {
  method: "POST",
  headers: {
    "X-API-Key": "$ALGA_API_KEY",
    "content-type": "string",
    "x-signature": "string",
    "x-idempotency-key": "string",
    "Content-Type": "application/json",
  },
  body: JSON.stringify(null)
});
const data = await response.json();

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://algapsa.com/api/inbound/{tenantSlug}/{webhookSlug}");
request.Headers.TryAddWithoutValidation("X-API-Key", "$ALGA_API_KEY");
request.Headers.TryAddWithoutValidation("content-type", "string");
request.Headers.TryAddWithoutValidation("x-signature", "string");
request.Headers.TryAddWithoutValidation("x-idempotency-key", "string");
request.Headers.TryAddWithoutValidation("Content-Type", "application/json");
request.Content = new StringContent(@"null", Encoding.UTF8, "application/json");
var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();

200 OK·application/json

{
  "delivery_id": "01HN2K7VRB9PQ3Y0000000000"
}