---
title: "Webhook Endpoint"
method: POST
path: "/api/psa/{team_key}/autotask/{connection_key}/webhook"
tags: ["psa"]
---

# Webhook Endpoint

`POST /api/psa/{team_key}/autotask/{connection_key}/webhook`

## Request

- Base URL: `https://api.superit.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.superit.ai/api/psa/{team_key}/autotask/{connection_key}/webhook`
- Auth: none declared

Receive callouts from Autotask.

401 when the signature does not verify -- such a request is not from
Autotask, so refusing it cannot contribute to the vendor's
delivery-failure count. 200 for everything past that gate, because
repeated failures get the webhook switched off.

The 401 detail is a constant, never the service's specific reason --
echoing "Unknown connection" vs "Invalid webhook signature" vs
"connection has no webhook secret configured" back to an unauthenticated
caller is an enumeration oracle. The specific reason is still logged
(structured) by ``process_autotask_webhook`` itself.

## Path parameters

- `team_key` string, required
- `connection_key` string, required

## Headers

- `x-hook-signature` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `400`: Invalid input
- `401`: Not authenticated
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `409`: Conflict
- `422`: Validation Error

---

[API](https://skmtc.dev/superit/apis/super-it-api.md) - [All operations](https://skmtc.dev/superit/apis/super-it-api/llms.txt) - [OpenAPI document](https://skmtc.dev/superit/apis/super-it-api/revisions/4944d556c2bb?raw)