Receive an aggregator webhook

Receives a Pluggy/Belvo aggregator webhook and asynchronously pulls the signaled data into the ingestion pipeline. This route carries no operator JWT. It is authenticated by an opaque token in the URL path (resolved to a tenant binding server-side, never claimed) PLUS a per-provider source check: a valid HMAC-SHA256 of the raw body in the X-Webhook-Signature header, OR membership in the provider’s source-IP allowlist. Both layers fail closed; the tenant is derived solely from the resolved token binding.

POST /v1/discovery/webhooks/{provider}/{webhookToken}

Receive an aggregator webhook

cURL

curl --request POST \
  --url https://matcher.sandbox.lerian.net/v1/discovery/webhooks/{provider}/{webhookToken} \
  --header 'Content-Type: application/octet-stream' \
  --header 'X-Webhook-Signature: <api-key>' \
  --data '<string>'

400

{
  "title": "Bad Request",
  "status": 400
}

Autorizaciones

X-Webhook-Signature · string · header · requerido

Hex HMAC-SHA256 of the raw request body, proving an inbound aggregator webhook originated from the configured provider.

Encabezados

X-Webhook-Signature · string

Hex HMAC-SHA256 of the raw body for signing providers; omitted by IP-allowlist providers

Parámetros de ruta

provider · string · requerido

Aggregator provider the token was minted for (pluggy or belvo)

Ejemplo:

"pluggy"

webhookToken · string · requerido

Opaque webhook token minted for the connection; hashed and resolved to a tenant binding server-side

Cuerpo

application/octet-stream

The body is of type file.

Respuesta

200

The event was already processed. Matcher acknowledges it and does not process it again.