---
title: "Provider webhook ingest (no user authentication)"
method: POST
path: "/api/v1/signals/inbound/{provider}/{inbound_token}"
tags: ["signals"]
---

# Provider webhook ingest (no user authentication)

`POST /api/v1/signals/inbound/{provider}/{inbound_token}`

## Request

- Base URL: `https://composal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://composal.com/api/v1/signals/inbound/{provider}/{inbound_token}`
- Auth: HTTP bearer

The endpoint Sentry and PlanetScale post to. There is no user session and no CSRF: the random `inbound_token` addresses the integration and the provider's HMAC-SHA256 over the RAW request body authenticates it. The response is returned before any normalization work, inside PlanetScale's two-second budget.

## Path parameters

- `provider` string, required
- `inbound_token` string, required
- `provider` 'sentry' | 'planetscale', required
- `inbound_token` string, required

## Request body

- object

## Response `200`

Success

- object

## Other responses

- `202`: Recorded. `state` is `pending` for an event that will become a signal and `ignored` for one the adapter recognizes and does not act on (a provider test ping, an installation notice).
- `401`: The signature is missing or does not match the stored webhook secret
- `403`: Forbidden
- `404`: No usable integration for this token — unknown, provider mismatch, or disabled. The three are deliberately indistinguishable.
- `409`: The same delivery id was replayed with different content
- `413`: The request body exceeds 1 MB
- `422`: Unprocessable entity
- `429`: Too many deliveries for this integration in the current minute
- `502`: Bad gateway
- `503`: Signal integrations are disabled (VEX_SIGNAL_INTEGRATIONS_DISABLED)

## Changes

- **2026-11-03** `74298a24e040`: 2 breaking, 2 warning
  - added the new path request parameter `inbound_token`
  - added the new path request parameter `provider`
  - deleted the `path` request parameter `inbound_token`
  - deleted the `path` request parameter `provider`
- **2026-11-02** `0afeb1a84736`: 2 breaking, 2 warning
  - added the new path request parameter `inbound_token`
  - added the new path request parameter `provider`
  - deleted the `path` request parameter `inbound_token`
  - deleted the `path` request parameter `provider`
- **2026-11-02** `d241f0ecfba3`: 2 breaking, 2 warning
  - added the new path request parameter `inbound_token`
  - added the new path request parameter `provider`
  - deleted the `path` request parameter `inbound_token`
  - deleted the `path` request parameter `provider`

[Operation history](https://skmtc.dev/composal/apis/vex-api/changes/api/v1/signals/inbound/:provider/:inbound_token/post.md)

---

[API](https://skmtc.dev/composal/apis/vex-api.md) - [All operations](https://skmtc.dev/composal/apis/vex-api/llms.txt) - [OpenAPI document](https://skmtc.dev/composal/apis/vex-api/revisions/74298a24e040?raw)