Bundled execution of the Webhook secure intake workflow
Bundled execution of the Webhook secure intake workflow - The production ingest path for every incoming webhook: verify the provider signature (GitHub / Stripe / Shopify / Slack, constant-time, replay-window enforced), schema-validate the now-trusted body against the provider envelope, fingerprint the raw bytes for redelivery dedup, normalize the event timestamp to UTC + epoch, and redact PII before anything hits a log. Five pure-CPU tools - the accept-or-reject gate, run on every event.
Paid test badge: not yet. The checks above are free: we call the tool without paying and read the payment request it sends back. The Verified badge needs paid calls whose answers match the promised output, and nobody can buy a badge.
Endpoint
POST https://agent402.tools/api/skill/webhook-intake
| Category | Code and developer |
|---|---|
| Provider host | agent402.tools |
| Networks | algorand:wGHE2Pwdvd7S12BL5FaOP20EGYesN73ktiC1qzkkit8=, eip155:10, eip155:1329, eip155:137, eip155:143, eip155:42161, eip155:42220, eip155:43114, eip155:4663, eip155:8453, solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp, stellar:pubnet |
| Payment schemes | exact, upto |
| Self-reported calls, 30 days | 2 from 1 payers (the provider's figure, not ours) |
Our checks, last 30 days
We never call tools that send, buy, move money or file anything, not even without paying.
Example input (from the provider)
{
"body": {
"provider": "github",
"rawBody": "{\"ref\":\"refs/heads/main\",\"before\":\"6113728f27ae82c7b1a177c8d03f9e96e0adf246\",\"after\":\"d6fde92930d4715a2b49857d24b940956b26d2d3\",\"repository\":{\"full_name\":\"acme/checkout-service\"},\"pusher\":{\"name\":\"alice\",\"email\":\"alice@example.com\"},\"head_commit\":{\"id\":\"d6fde92930d4715a2b49857d24b940956b26d2d3\",\"message\":\"fix: retry payment capture on 5xx\",\"timestamp\":\"2026-07-01T15:04:05Z\"}}",
"secret": "gh_hook_secret_demo_only",
"signature": "sha256=45f74caa8f537323fd4fa022357ebc620cbcfb28a6dcd65b0f1da3646edf5c4a"
},
"bodyType": "json",
"method": "POST",
"type": "http"
}
Promised output schema (from the provider)
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"properties": {
"provider": {
"description": "which provider signed the webhook: github | stripe | shopify | slack",
"type": "string"
},
"rawBody": {
"description": "the raw webhook body exactly as received on the wire (signatures are over the raw bytes)",
"type": "string"
},
"secret": {
"description": "the webhook signing secret from the provider dashboard (never echoed back)",
"type": "string"
},
"signature": {
"description": "the signature header value, with or without its scheme prefix (sha256= / v0= / t=...,v1=...)",
"type": "string"
},
"timestamp": {
"description": "the provider timestamp header - required for stripe/slack replay protection (stripe's may ride in the signature's t= element)",
"type": "string"
}
},
"required": [
"rawBody",
"provider",
"secret",
"signature"
]
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"properties": {
"args": {
"properties": {
"provider": {
"type": "string"
},
"rawBody": {
"type": "string"
},
"secret": {
"type": "string"
},
"signature": {
"type": "string"
},
"timestamp": {}
},
"type": "object"
},
"pack": {
"type": "string"
},
"steps": {
"items": {
"properties": {
"ok": {
"type": "boolean"
},
"result": {
"type": "object"
},
"slug": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
},
"summary": {
"type": "string"
}
},
"required": [
"pack",
"args",
"steps",
"summary"
],
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}