Docs / Endpoints: webhooks, APIs, MCP, apps

Senders and verification

A webhook is only worth accepting if it came from the system it claims. Each sender proves that its own way — a signature over the body, a token in a header, a certificate, a registration handshake — and the platform holds each way as one row of data, with the recorded requests that prove it. You pick your sender and the verification recipe is filled in; you enter only the secret or the trust anchor. Your first automation is the page that walks a webhook endpoint end to end.

The senders

a9script, Amazon SNS, GitHub, Atlassian Jira, Linear, Microsoft Graph, Okta, Shopify, Slack, Standard Webhooks, Stripe, Twilio, Xurrent, Zoom.

A sender not in the list is described in the same vocabulary as a custom recipe: where the signature is, what it covers, how the timestamp is read. A request the recipe cannot answer for is refused — a verification is never assembled from whatever happens to be present.

Incoming credentials

None, bearer, basic, signed (HMAC), JWT, AWS SNS, or a shared secret. A signed endpoint verifies against the sender’s replay window where the sender sends a timestamp, and accepts the previous secret during a rotation, so you rotate without a gap. A JWT endpoint trusts the issuer you name — its keys, its name, its origin.

Registration handshakes

Some senders confirm a subscription by calling first and expecting an echo or a signed token back. Those handshakes are answered by the platform without a run: the echo before the credential (that is how the sender registers), the signed answer only after the request authenticated. A handshake that would subscribe a switched-off endpoint is not confirmed.

Networks

List the networks an endpoint accepts and every other address gets the same refusal as a wrong credential. A sender whose profile publishes its ranges has them merged in, so a new address of theirs is never a silent outage. An endpoint whose only credential is a network range is refused until you acknowledge that choice. Behind a reverse proxy, the installation names the trusted proxy so the caller’s address is the real one — an address the caller wrote is never trusted.

One delivery, one run

A sender that ships a delivery id has a repeated delivery dropped at the endpoint. Give the connection your own identity in that system and add ignore rules to the endpoint, and your own writes coming back are dropped before any script runs; only a matching rule drops an event.

Bounded

A request body is capped, and calls are counted per tenant and per endpoint within a window. Over the window a caller gets 429 with a Retry-After header; over the cap, 413. The numbers are on Limits and safety.