Rensei docs
API ReferenceWebhooks

Inbound webhook from a provider

Unified ingest endpoint for Linear, GitHub, GitHub Actions, and Vercel webhooks. Validates HMAC signature, checks idempotency, and immediately returns 200. All routing/execution is deferred via `after()`. Duplicate deliveries are detected via the gateway's idempotency layer and return `{ ok: true, duplicate: true }`. Providers register at: `POST /api/integrations/{provider}/oauth/authorize`.

POST
/api/webhooks/ingest/{provider}

Authorization

webhookHmac
headerx-hub-signature-256<token>

Provider-specific HMAC signature. The actual header is selected by provider and documented on the webhook operation.

Path Parameters

provider*string
Value in"linear""github""github-actions""vercel"

Request Body

application/json
  1. body

Provider-specific event payload.

[key: string]?any

Response Body

Immediate ACK. All processing happens asynchronously.

application/json
  1. response
ok*boolean
eventId*string
correlationId*string
duplicate?boolean
Example Request
curl -X POST 'https://app.rensei.ai/api/webhooks/ingest/linear' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "ok": true,  "eventId": "string",  "correlationId": "string",  "duplicate": true}

Get one template catalogue entry with its version list.

Returns a single template (by slug) plus its version list (newest first). Human principals only: a browser session or a WorkOS user-token bearer is accepted; rsk_* API keys and BYOA OAuth-agent tokens authenticate but are rejected 403. Templates are tenant-private: only the authoring org or a first-party `rensei` system template is visible; any other slug returns 404 so existence is not leaked across the tenant boundary. For shared `rensei` templates, per-version publisher identity and validation reports are stripped.

Inbound webhook from incident.io

Dedicated ingest endpoint for incident.io webhooks. Streams the exact provider-signed bytes under a hard 1 MiB cap before strictly decoding UTF-8. Validates the Svix `webhook-id`, `webhook-timestamp`, and `webhook-signature` headers, including a five-minute replay window, and routes only when exactly one connected per-org encrypted signing secret matches. Handles `incident.created`, `incident.updated`, and `incident.resolved` events. Unknown event types return `{ ok: true, skipped: true }`. Missing, stale, malformed, duplicate, undecryptable, or over-cap candidate state fails closed with 401. `WEBHOOK_SECRET_INCIDENT_IO` is a bounded legacy fallback for exactly one connected env-only row and is never an alternate key for connected per-org rows.