{"uid":"cap_Md11McbGhqeEAqe3c9gV3","slug":"agent402-tools-webhook-secure-intake-34ef4b41","name":"agent402.tools Webhook Secure Intake","description":"Bundled execution of the Webhook secure intake workflow - The production ingest path for every incoming webhook: verify the provider signature (GitHub / Stripe / Shopify / Slack, constant-time, replay-window enforced), schema-validate the now-trusted body against the provider envelope, fingerprint the raw bytes for redelivery dedup, normalize the event timestamp to UTC + epoch, and redact PII before anything hits a log. Five pure-CPU tools - the accept-or-reject gate, run on every event.","url":"https://agent402.tools/api/skill/webhook-intake","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"secret":{"type":"string","description":"the webhook signing secret from the provider dashboard (never echoed back)"},"rawBody":{"type":"string","description":"the raw webhook body exactly as received on the wire (signatures are over the raw bytes)"},"provider":{"type":"string","description":"which provider signed the webhook: github | stripe | shopify | slack"},"signature":{"type":"string","description":"the signature header value, with or without its scheme prefix (sha256= / v0= / t=...,v1=...)"},"timestamp":{"type":"string","description":"the provider timestamp header - required for stripe/slack replay protection (stripe's may ride in the signature's t= element)"}}},"responseSchema":{"type":"json","example":{"args":{"secret":"gh_hook_secret_demo_only","rawBody":"{\"ref\":\"refs/heads/main\",\"before\":\"6113728f27ae82c7b1a177c8d03f9e96e0adf246\",\"after\":\"d6fde92930d4715a2b49857d24b940956b26d2d3\",\"repository\":{\"full_name\":\"acme/checkout-service\"},\"pusher\":{\"name\":\"alice\",\"email\":\"alice@example.com\"},\"head_commit\":{\"id\":\"d6fde92930d4715a2b49857d24b940956b26d2d3\",\"message\":\"fix: retry payment capture on 5xx\",\"timestamp\":\"2026-07-01T15:04:05Z\"}}","provider":"github","signature":"sha256=45f74caa8f537323fd4fa022357ebc620cbcfb28a6dcd65b0f1da3646edf5c4a"},"pack":"webhook-intake","steps":[{"ok":true,"slug":"webhook-verify","result":{}},{"ok":true,"slug":"json-validate","result":{}},{"ok":true,"slug":"hash","result":{}},{"ok":true,"slug":"time-convert","result":{}},{"ok":true,"slug":"redact","result":{}}],"summary":"5/5 steps succeeded"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.006","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.006/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.006","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_UzvNDY9Op-hff_5k4tfQd","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.006","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies webhook signatures from GitHub, Stripe, Shopify, or Slack (constant-time, replay-window enforced), then schema-validates and normalizes the payload in a single bundled call.","exampleAgentPrompt":"Verify this incoming Stripe webhook for me — the raw body is the JSON string I received, the signature header is 't=1714000000,v1=abc123...', my signing secret is 'whsec_xxxx', and the timestamp is '1714000000'.","exampleUseCases":null,"resultDescription":"Returns a verified and schema-validated webhook payload, confirming the signature is authentic and the event is within the replay protection window, along with the normalized event data ready for downstream processing.","failureModes":["Invalid or mismatched signature returns authentication failure","Timestamp outside replay window returns replay attack rejection","Unsupported provider name returns validation error","Malformed raw body causes signature verification failure","Missing required fields (secret, rawBody, provider, signature) returns 400 error"],"whenToPreferThis":"Use this endpoint when you need a single, bundled call that handles both signature verification and schema validation for webhooks from GitHub, Stripe, Shopify, or Slack — especially when you need constant-time comparison and replay-window enforcement without building that logic yourself.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T06:33:45.459Z","isFirstParty":false}