The webhook.* family (2 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Ingestwebhook.ingest
| Property | Value |
|---|---|
| Capability | webhook.ingest |
| Risk class | Write - autonomy L1 |
| Min. permission | External (portal / signer token) |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
The ONE inbound rail/ledger webhook guard
(NFR-SEC-5): HMAC-SHA256 verify_slice (constant-time) over the raw body BEFORE any DB write, then
verify_webhook→map_event_to_payment on the rail, then a Payment via the SAME record path
(INV-1), idempotent on the provider event id (P-dedup ⇒ silent, no double-charge). The inbound
webhook is NOT egress (it receives + verifies, never calls out). { rawBody, signature }.
Call POST /v/webhook.ingest with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Sendwebhook.send
| Property | Value |
|---|---|
| Capability | webhook.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | Webhook - a signed outbound webhook to an external endpoint |
| High-risk oversight | Human four-eyes approval in HIGH-risk orgs (EU AI Act Art. 14) |
A write operation in the webhook.* family. Called through the one governed front door: capability, permission tier, autonomy, scope and egress are all resolved before the handler runs, and the call is audited (INV-1, INV-8).
Call POST /v/webhook.send with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.