Rensei docs
API ReferenceWebhooks

Inbound webhook from a provider

Unified ingest endpoint for Linear, GitHub, GitHub Actions, and Vercel webhooks. Validates HMAC signature, checks idempotency, and immediately returns 200. All routing/execution is deferred via `after()`. Duplicate deliveries are detected via the gateway's idempotency layer and return `{ ok: true, duplicate: true }`. Providers register at: `POST /api/integrations/{provider}/oauth/authorize`.

POST
/api/webhooks/ingest/{provider}

Authorization

webhookHmac
x-hub-signature-256<token>

Provider-specific HMAC signature. The actual header is selected by provider and documented on the webhook operation.

In: header

Path Parameters

provider*string
Value in"linear" | "github" | "github-actions" | "vercel"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

[key: string]?any

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/webhooks/ingest/linear" \  -H "Content-Type: application/json" \  -d '{}'
{
  "ok": true,
  "eventId": "string",
  "correlationId": "string",
  "duplicate": true
}
{
  "error": "Session not found"
}
{
  "error": "Session not found"
}
{
  "error": "Session not found"
}

Get one template catalogue entry with its version list.

Returns a single template (by slug) plus its version list (newest first). Human principals only: a browser session or a WorkOS user-token bearer is accepted; rsk_* API keys and BYOA OAuth-agent tokens authenticate but are rejected 403. Templates are tenant-private: only the authoring org or a first-party `rensei` system template is visible; any other slug returns 404 so existence is not leaked across the tenant boundary. For shared `rensei` templates, per-version publisher identity and validation reports are stripped.

Inbound webhook from incident.io

Dedicated ingest endpoint for incident.io webhooks. Streams the exact provider-signed bytes under a hard 1 MiB cap before strictly decoding UTF-8. Validates the Svix `webhook-id`, `webhook-timestamp`, and `webhook-signature` headers, including a five-minute replay window, and routes only when exactly one connected per-org encrypted signing secret matches. Handles `incident.created`, `incident.updated`, and `incident.resolved` events. Unknown event types return `{ ok: true, skipped: true }`. Missing, stale, malformed, duplicate, undecryptable, or over-cap candidate state fails closed with 401. `WEBHOOK_SECRET_INCIDENT_IO` is a bounded legacy fallback for exactly one connected env-only row and is never an alternate key for connected per-org rows.