---
title: "Receive a webhook"
method: POST
path: "/{user-slug}/{app-slug}"
---

# Receive a webhook

`POST /{user-slug}/{app-slug}`

## Request

- Base URL: `https://in.anyhook.net`
- URL: `https://in.anyhook.net/{user-slug}/{app-slug}`
- Auth: none required

Receives an inbound webhook from any sender. Answers 200 once the event is durably queued, in about a second; delivery to your destinations is asynchronous. When the app has a source and signing secret set, the sender's signature is checked here before anything is stored (Stripe-Signature, X-Hub-Signature-256, X-Shopify-Hmac-Sha256, x-line-signature, Standard Webhooks' webhook-signature and the other schemes listed at https://anyhook.net/docs#sources). A Generic app is not signature-checked. No authentication is required on this endpoint. Only POST is accepted, apart from Meta's GET hub.mode=subscribe handshake. Browsers can post too: an OPTIONS preflight is answered, every answer carries Access-Control-Allow-Origin: *, and a plain form submitted with ?redirect= set to a page on the form's own site (its Origin or Referer) is redirected there once the event is stored. Bodies are kept as text: JSON, form-urlencoded and other text bodies are forwarded byte-for-byte, binary bodies and multipart file uploads are not.

## Path parameters

- `user-slug` string, required
- `app-slug` string, required

## Response `200`

Event stored and queued for delivery.

## Other responses

- `202`: The app is paused: the request is acknowledged and discarded (body reason `app_inactive`), nothing is stored. A 202 rather than an error keeps the provider from disabling the endpoint.
- `401`: The sender's signature did not verify. The app's page counts these, and the first 5 a day are kept in the event log as `rejected`, headers and body included.
- `404`: No app at this URL.
- `413`: Payload exceeds the plan limit: 512 KB (Free), 2 MB (Pro), 4 MB (Scale).
- `429`: Refused: past the Free plan's daily cap, or past 12x the monthly quota. Below that ceiling, events past the quota are stored as `quota_exceeded` and replayable.
- `503`: The event could not be stored (queue and both fallbacks unavailable). Nothing was kept, so the sender's own retry is the safety net.

---

[API](https://skmtc.dev/anyhook/apis/anyhook-api.md) · [All operations](https://skmtc.dev/anyhook/apis/anyhook-api/llms.txt) · [OpenAPI document](https://skmtc.dev/anyhook/apis/anyhook-api/revisions/ddf038fb32fc?raw)