Skip to main content
POST
Receive an aggregator webhook

Authorizations

X-Webhook-Signature
string
header
required

Hex HMAC-SHA256 of the raw request body, proving an inbound aggregator webhook originated from the configured provider.

Headers

X-Webhook-Signature
string

Hex HMAC-SHA256 of the raw body for signing providers; omitted by IP-allowlist providers

Path Parameters

provider
string
required

Aggregator provider the token was minted for (pluggy or belvo)

Example:

"pluggy"

webhookToken
string
required

Opaque webhook token minted for the connection; hashed and resolved to a tenant binding server-side

Body

application/octet-stream

The body is of type file.

Response

Accepted