---
title: "Asana Webhook"
method: POST
path: "/integrations/asana/webhook"
tags: ["integration-callbacks"]
---

# Asana Webhook

`POST /integrations/asana/webhook`

## Request

- Base URL: `https://api.withverifa.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.withverifa.com/integrations/asana/webhook`
- Auth: none declared

Handle Asana webhook events.

Implements Asana's documented webhook security model (closes audit
FINDING [ASANA-AUTH]):

- Handshake: Asana sends ``X-Hook-Secret``; we persist it into the
  integration's encrypted credentials and echo it back.
- Deliveries: when a stored hook secret exists, ``X-Hook-Signature``
  (HMAC-SHA256 of the raw body) is verified against it. Integrations
  that never completed a handshake (no stored secret) are accepted
  unverified so existing wiring keeps working.
- No Asana integration wired at all → 404 (don't advertise the endpoint).

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/withverifa/apis/verifa.md) · [All operations](https://skmtc.dev/withverifa/apis/verifa/llms.txt) · [OpenAPI document](https://skmtc.dev/withverifa/apis/verifa/revisions/7288c82c9e33?raw)