---
title: "Receive an authenticated source webhook"
method: POST
path: "/webhooks/signals/{provider}"
tags: ["observations"]
---

# Receive an authenticated source webhook

`POST /webhooks/signals/{provider}`

## Request

- Base URL: `https://api.runx.ai`
- URL: `https://api.runx.ai/webhooks/signals/{provider}`
- Auth: none declared

Uses the configured provider HMAC secret and source policy binding to resolve the tenant. Maximum body size is 1 MiB. Slack verification challenges return text/plain.

## Path parameters

- `provider` string, required

## Response `200`

Duplicate delivery or Slack challenge.

- SourceObservationEnvelope
  - `status` 'accepted' | 'duplicate', required
  - `observation` SourceObservation, required
    - `schema` 'runx.source_observation.v1', required
    - `observation_id` string, required
    - `content_hash` string, required
    - `source_policy_digest` string, required
    - `admitted_at` string, date-time, required
    - `signal` RunxSignal, required
      - `authenticity` object
        - `evidence_refs` object[]
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
        - `host_ref` object, required
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
        - `principal_ref` object
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
        - `signature_refs` object[]
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
        - `trust_level` 'unverified' | 'observed' | 'verified_delivery' | 'verified_signature' | 'operator_attested', required
        - `verified_at` string
        - `verified_by_ref` object
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
      - `body_preview` string
      - `evidence_refs` object[]
        - `label` string
        - `locator` string
        - `observed_at` string
        - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
        - `provider` string
        - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
        - `uri` string, required
      - `extensions` object
      - `fingerprint` object
        - `algorithm` 'sha256', required
        - `canonicalization` string, required
        - `derived_from` object[], required
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
        - `value` string, required
      - `links` object
        - `duplicate_candidates` object[]
          - `candidate_ref` object, required
            - `label` string
            - `locator` string
            - `observed_at` string
            - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
            - `provider` string
            - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
            - `uri` string, required
          - `confidence` number, required
          - `evidence_refs` object[]
            - `label` string
            - `locator` string
            - `observed_at` string
            - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
            - `provider` string
            - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
            - `uri` string, required
          - `observed_at` string, required
          - `reviewer_refs` object[]
            - `label` string
            - `locator` string
            - `observed_at` string
            - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
            - `provider` string
            - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
            - `uri` string, required
        - `duplicate_of` object
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
        - `related` object[]
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
        - `superseded_by` object[]
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
        - `supersedes` object[]
          - `label` string
          - `locator` string
          - `observed_at` string
          - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
          - `provider` string
          - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
          - `uri` string, required
      - `observed_at` string, required
      - `schema` 'runx.signal.v1', required
      - `signal_id` string, required
      - `signal_type` string, required
      - `source_ref` object, required
        - `label` string
        - `locator` string
        - `observed_at` string
        - `proof_kind` 'effect_evidence' | 'effect_finality' | 'credential_resolution'
        - `provider` string
        - `type` 'thread' | 'comment' | 'event' | 'tracking_item' | 'change_request' | 'repository' | 'signal' | 'run' | 'act' | 'receipt' | 'artifact' | 'verification' | 'harness' | 'host' | 'surface' | 'target' | 'skill_binding' | 'principal' | 'scope_admission' | 'grant' | 'mandate' | 'credential' | 'webhook_delivery' | 'redaction_policy' | 'external_url' | 'connector_instance' | 'connector_operation', required
        - `uri` string, required
      - `title` string, required

## Other responses

- `202`: Observation admitted.
- `401`: Invalid provider signature.
- `409`: Conflicting delivery identity.

---

[API](https://skmtc.dev/runx/apis/runx-hosted-api.md) · [All operations](https://skmtc.dev/runx/apis/runx-hosted-api/llms.txt) · [OpenAPI document](https://skmtc.dev/runx/apis/runx-hosted-api/revisions/6c940d8edacc?raw)