Skip to main content
Version: v5.6.1

opschain admin inbound-webhooks

Included from Basic tier

Manage inbound webhook connections: the signed endpoints external systems fire OpsChain triggers through. Each connection serves POST /api/hooks/<code> — unauthenticated by design except the HMAC signature, which is the authentication — and defines:

  • an HMAC-SHA256 signing secret (write-only: encrypted at rest, never echoed by any read; at least 16 characters). The endpoint accepts both the GitHub-style X-Hub-Signature-256: sha256=<hex> shape (HMAC over the raw body) and the generic X-OpsChain-Signature: v1=<hex> shape (HMAC over <timestamp>.<body>, with X-OpsChain-Timestamp);
  • a service account: the username every trigger firing the connection causes executes — and is authorization-checked — as. An inbound call never carries ambient authority, whoever owns the matching trigger;
  • a replay window (default 300 seconds): signed timestamps outside it refuse by name, and delivery ids (X-GitHub-Delivery / X-OpsChain-Delivery, else the body digest) dedup exactly-once;
  • a rate limit (default 60 requests/minute): requests beyond it answer 429 before any verification.

A verified delivery lands as one external:webhook:received event carrying the payload under data.payload; triggers bind to it with subject external, the external:webhook:received event name and conditions such as event.data.connection eq <code> and event.data.event eq push (see opschain docs triggers). Every named refusal — bad signature, stale timestamp, replayed delivery, disabled or unknown connection — answers a typed 4xx and a warn:webhooks:refused event; nothing is silently dropped.

Every verb sits behind the admin-plane authorization determination, and every write is audited (api:inbound_webhooks:create|update|destroy).

Verbs​

  • opschain docs cli/admin-inbound-webhooks-list — the connection table.
  • opschain docs cli/admin-inbound-webhooks-show — one connection in full.
  • opschain docs cli/admin-inbound-webhooks-create — register a connection.
  • opschain docs cli/admin-inbound-webhooks-update — change fields or rotate the secret.
  • opschain docs cli/admin-inbound-webhooks-delete — remove a connection.