Called by the provider, not by clients of ours. The token in the URL is the endpoint's credential and identifies the integration; each provider adapter then validates its own signature. Bodies are provider-specific and capped at 10 MiB.

Answers 200 for anything a redelivery cannot fix — unknown token, bad signature, unparseable payload — because re-sending the same thing buys nothing and costs a retry storm. 503 is reserved for the one case worth redelivering: the payload was good and this service could not take it.