---
title: "Monday Webhook"
method: POST
path: "/integrations/monday/webhook"
tags: ["integration-callbacks"]
---

# Monday Webhook

`POST /integrations/monday/webhook`

## Request

- Base URL: `https://api.withverifa.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.withverifa.com/integrations/monday/webhook`
- Auth: none declared

Handle Monday.com webhook events.

Auth (closes audit FINDING [MONDAY-AUTH]): Monday sends a JWT in the
``Authorization`` header signed with the app's signing secret (HS256).
When any enabled Monday integration stores a ``signing_secret``
credential, event deliveries must carry a JWT that verifies against one
of them. The challenge handshake is answered after the 404 existence
gate but before JWT verification, mirroring the Slack url_verification
precedent. No Monday integration wired at all → 404.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/withverifa/apis/verifa.md) · [All operations](https://skmtc.dev/withverifa/apis/verifa/llms.txt) · [OpenAPI document](https://skmtc.dev/withverifa/apis/verifa/revisions/7288c82c9e33?raw)