webhook-skills

Receive and verify Adyen webhooks (standard notifications). Use when setting up Adyen webhook handlers, debugging HMAC signature verification, or handling payment events like AUTHORISATION, CAPTURE, REFUND, CANCELLATION, and CHARGEBACK.

Receive and verify AfterShip webhooks. Use when setting up AfterShip webhook handlers, debugging AfterShip signature verification (aftership-hmac-sha256, as-signature-hmac-sha256, am-webhook-signature), or handling AfterShip Tracking events like tracking_update, edd_revise and tracking_pending_time, AfterShip Returns events like return.approved, AfterShip Warranty events like warranty.created, and AfterShip Shipping (Postmen) events like create_a_label.

Receive and verify AiPrise webhooks (callbacks). Use when setting up AiPrise identity/KYC/KYB callback handlers, debugging X-HMAC-SIGNATURE verification, or handling verification results like APPROVED, DECLINED, REVIEW, and UNKNOWN.

Receive and verify Aircall webhooks. Use when setting up Aircall webhook handlers, debugging Aircall webhook token verification, or handling Aircall cloud phone events like call.created, call.answered, call.ended, message.received, contact.updated, or user.connected.v2. Aircall does NOT use an HMAC signature — verification is a timing-safe comparison of the `token` field inside the JSON body.

Receive and verify Airtable webhooks. Use when setting up Airtable webhook handlers, debugging X-Airtable-Content-MAC signature verification, handling the thin-ping notification, or fetching base changes (tableData, tableFields, tableMetadata add/remove/update) from the webhook payloads API.

Receive and verify Airwallex webhooks. Use when setting up Airwallex webhook handlers, debugging x-signature / x-timestamp signature verification, or handling payment events like payment_intent.succeeded, payment_attempt.paid, refund.settled, payment_consent.verified, or payment_dispute.requires_response.

Receive and verify Akeneo PIM (Events API) webhooks. Use when setting up Akeneo webhook handlers, debugging x-akeneo-request-signature verification, or handling batched product and product-model events like product.created, product.updated, product.removed, product_model.created, product_model.updated, or product_model.removed.

Receive and verify Alchemy Notify webhooks. Use when setting up Alchemy webhook handlers, debugging X-Alchemy-Signature verification, or handling onchain events like ADDRESS_ACTIVITY, NFT_ACTIVITY, or GRAPHQL (Custom Webhook).

Receive and verify Alipay (Antom / Alipay+) webhook notifications. Use when setting up Alipay webhook handlers, debugging RSA256 Signature header verification, or handling payment events like notifyPayment, notifyCapture, notifyRefund, notifyAuthorization, and notifyDispute.

Receive and verify Asana webhooks. Use when setting up Asana webhook handlers, implementing the X-Hook-Secret handshake, debugging X-Hook-Signature verification, or handling task, project, and story events like added, changed, removed, deleted, and undeleted.

Receive and verify Ascend webhooks. Use when setting up Ascend webhook handlers, debugging Ascend signature verification (X-Ascend-Signature, HMAC-SHA256), or handling insurance payment events like invoice.paid, payout.paid, and refund.paid.

Receive and verify Ashby webhooks. Use when setting up Ashby webhook handlers, debugging Ashby-Signature verification, or handling recruiting events like applicationSubmit, candidateHire, candidateStageChange, or interviewScheduleCreate.

Receive and verify Attentive webhooks. Use when setting up Attentive webhook handlers, debugging signature verification (x-attentive-hmac-sha256), or handling SMS and email events like sms.subscribed, sms.unsubscribed, email.opened, or custom_attribute.set.

Receive and verify Auth0 webhooks delivered via Custom Log Streams (HTTP). Use when setting up an Auth0 log stream HTTP endpoint, validating the configured Authorization token, or handling batched authentication log events like s (success login), f (failed login), ss (signup), and sepft (password-grant token exchange).

Receive and verify AWS SNS (Amazon Simple Notification Service) webhooks over HTTP/HTTPS. Use when setting up an SNS HTTP subscription endpoint, confirming a subscription (SubscriptionConfirmation / SubscribeURL), verifying SNS message signatures (SigningCertURL, SignatureVersion 1 SHA1 / 2 SHA256), or handling Notification and UnsubscribeConfirmation messages.

Receive and validate Azure Event Grid webhook deliveries. Use when setting up an Event Grid WebHook event handler, implementing the Microsoft.EventGrid.SubscriptionValidationEvent handshake (echo data.validationCode as validationResponse with HTTP 200), implementing the CloudEvents v1.0 HTTP OPTIONS abuse-protection preflight (WebHook-Request-Origin / WebHook-Allowed-Origin), checking the aeg-subscription-name / aeg-event-type / aeg-delivery-count headers, authenticating deliveries with a static delivery-property header or a Microsoft Entra ID bearer token, parsing Event Grid schema arrays vs CloudEvents objects, or handling events like Microsoft.Storage.BlobCreated. Event Grid does NOT sign the request body — there is no HMAC signature.

Receive BaseLinker (Base.com) webhooks. Use when building a BaseLinker order or warehouse callback receiver, because BaseLinker is not a normal webhook source: deliveries arrive as HTTP HEAD requests with NO body, the entire payload is in the query string (observed params: order_id, state), there is NO signature verification of any kind (no HMAC, no secret, no handshake), and your response must be a bare bodyless 200. Use when debugging an empty req.body, wiring app.head / an exported HEAD route handler / @app.head, or polling getJournalList for change tracking.

Receive and verify BigCommerce webhooks. Use when setting up BigCommerce webhook handlers, debugging Standard Webhooks signature verification, or handling store events like store/order/created, store/order/statusUpdated, store/product/updated, or store/cart/abandoned.

Receive and verify Bitbucket Cloud webhooks. Use when setting up Bitbucket webhook handlers, debugging X-Hub-Signature verification, or handling repository and pull request events like repo:push, pullrequest:created, pullrequest:updated, pullrequest:fulfilled, or pullrequest:rejected.

Receive and verify Bridge API webhooks (bridgeapi.io — the open-banking aggregator by Bridge/Bankin', NOT bridge.xyz). Use when setting up Bridge API webhook handlers, debugging BridgeApi-Signature HMAC-SHA256 verification, or handling events like item.created, item.refreshed, item.account.updated, payment.transaction.created, or user.deleted.