Receive an aggregator webhook
Receives a Pluggy/Belvo aggregator webhook and asynchronously pulls the signaled data into the ingestion pipeline. This route carries no operator JWT. It is authenticated by an opaque token in the URL path (resolved to a tenant binding server-side, never claimed) PLUS a per-provider source check: a valid HMAC-SHA256 of the raw body in the X-Webhook-Signature header, OR membership in the provider’s source-IP allowlist. Both layers fail closed; the tenant is derived solely from the resolved token binding.
Autorizações
Hex HMAC-SHA256 of the raw request body, proving an inbound aggregator webhook originated from the configured provider.
Cabeçalhos
Hex HMAC-SHA256 of the raw body for signing providers; omitted by IP-allowlist providers
Parâmetros de caminho
Aggregator provider the token was minted for (pluggy or belvo)
"pluggy"
Opaque webhook token minted for the connection; hashed and resolved to a tenant binding server-side
Corpo
The body is of type file.
Resposta
Accepted

