> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Receive an aggregator webhook > Receives a Pluggy/Belvo aggregator webhook and asynchronously pulls the signaled data into the ingestion pipeline. This route carries no operator JWT. It is authenticated by an opaque token in the URL path (resolved to a tenant binding server-side, never claimed) PLUS a per-provider source check: a valid HMAC-SHA256 of the raw body in the X-Webhook-Signature header, OR membership in the provider's source-IP allowlist. Both layers fail closed; the tenant is derived solely from the resolved token binding. ## OpenAPI ````yaml /pt/openapi/v3-current/matcher.yaml post /v1/discovery/webhooks/{provider}/{webhookToken} openapi: 3.1.0 info: title: Matcher APIs description: >- Complete API reference for the Matcher reconciliation engine, providing automated transaction matching between Midaz Ledger and external systems. version: 5.0.4 license: name: Lerian Studio General License servers: - url: https://matcher.sandbox.lerian.net security: [] paths: /v1/discovery/webhooks/{provider}/{webhookToken}: post: tags: - Discovery summary: Receive an aggregator webhook description: >- Receives a Pluggy/Belvo aggregator webhook and asynchronously pulls the signaled data into the ingestion pipeline. This route carries no operator JWT. It is authenticated by an opaque token in the URL path (resolved to a tenant binding server-side, never claimed) PLUS a per-provider source check: a valid HMAC-SHA256 of the raw body in the X-Webhook-Signature header, OR membership in the provider's source-IP allowlist. Both layers fail closed; the tenant is derived solely from the resolved token binding. operationId: receiveAggregatorWebhook parameters: - description: Aggregator provider the token was minted for (pluggy or belvo) in: path name: provider required: true schema: description: Aggregator provider the token was minted for (pluggy or belvo) examples: - pluggy type: string - description: >- Opaque webhook token minted for the connection; hashed and resolved to a tenant binding server-side in: path name: webhookToken required: true schema: description: >- Opaque webhook token minted for the connection; hashed and resolved to a tenant binding server-side type: string - description: >- Hex HMAC-SHA256 of the raw body for signing providers; omitted by IP-allowlist providers in: header name: X-Webhook-Signature schema: description: >- Hex HMAC-SHA256 of the raw body for signing providers; omitted by IP-allowlist providers type: string requestBody: content: application/octet-stream: schema: contentMediaType: application/octet-stream format: binary type: string required: true responses: '200': description: >- The event was already processed. Matcher acknowledges it and does not process it again. '202': description: Accepted '400': description: The webhook body is not a recognized event. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' examples: 400-bad-request: $ref: '#/components/examples/400-bad-request' '401': description: The webhook source could not be verified. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' examples: 401-unauthorized: $ref: '#/components/examples/401-unauthorized' '404': description: The provider or the webhook token is not recognized. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' examples: 404-no-detail: $ref: '#/components/examples/404-no-detail' '500': $ref: '#/components/responses/InternalServerError' '503': description: The service is temporarily unavailable. Please try again later. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' examples: 503-internal-error: $ref: >- #/components/examples/503-internal-error--post-v1-discovery-webhooks-provider-webhooktoken security: - {} - WebhookSignature: [] components: schemas: Detail: additionalProperties: false properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). examples: - ERR-0001 type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object examples: 400-bad-request: summary: Bad Request value: title: Bad Request status: 400 401-unauthorized: summary: Unauthorized value: title: Unauthorized status: 401 404-no-detail: summary: Not Found value: title: Not Found status: 404 503-internal-error--post-v1-discovery-webhooks-provider-webhooktoken: summary: Service Unavailable value: type: https://errors.lerian.studio/v1/MTCH-0008 title: Service Unavailable status: 503 detail: internal error code: MTCH-0008 responses: InternalServerError: description: An unexpected error occurred on the server. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' example: type: https://errors.lerian.studio/v1/MTCH-0002 title: Internal Server Error status: 500 detail: internal error code: MTCH-0002 text/plain: schema: type: string example: Internal Server Error securitySchemes: WebhookSignature: description: >- Hex HMAC-SHA256 of the raw request body, proving an inbound aggregator webhook originated from the configured provider. in: header name: X-Webhook-Signature type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.