# agent402.tools Webhook Secure Intake

> agent402.tools Webhook Secure Intake is a paid API for AI agents from agent402.tools, paid per call via x402, $0.006/call, status unknown (last checked 2026-09-13).

Verifies webhook signatures from GitHub, Stripe, Shopify, or Slack (constant-time, replay-window enforced), then schema-validates and normalizes the payload in a single bundled call.

## Facts

- Endpoint: POST https://agent402.tools/api/skill/webhook-intake
- Price: $0.006/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent402-tools-webhook-secure-intake-34ef4b41
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Md11McbGhqeEAqe3c9gV3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent402-tools-webhook-secure-intake-34ef4b41 -d '<json body>'
```

Example prompt: Verify this incoming Stripe webhook for me — the raw body is the JSON string I received, the signature header is 't=1714000000,v1=abc123...', my signing secret is 'whsec_xxxx', and the timestamp is '1714000000'.

## When to prefer this

Use this endpoint when you need a single, bundled call that handles both signature verification and schema validation for webhooks from GitHub, Stripe, Shopify, or Slack — especially when you need constant-time comparison and replay-window enforcement without building that logic yourself.

## Known failure modes

- Invalid or mismatched signature returns authentication failure
- Timestamp outside replay window returns replay attack rejection
- Unsupported provider name returns validation error
- Malformed raw body causes signature verification failure
- Missing required fields (secret, rawBody, provider, signature) returns 400 error

## How this service works

Bundled execution of the Webhook secure intake workflow - The production ingest path for every incoming webhook: verify the provider signature (GitHub / Stripe / Shopify / Slack, constant-time, replay-window enforced), schema-validate the now-trusted body against the provider envelope, fingerprint the raw bytes for redelivery dedup, normalize the event timestamp to UTC + epoch, and redact PII before anything hits a log. Five pure-CPU tools - the accept-or-reject gate, run on every event.

## Output

Returns a verified and schema-validated webhook payload, confirming the signature is authentic and the event is within the replay protection window, along with the normalized event data ready for downstream processing.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "secret": {
   "type": "string",
   "description": "the webhook signing secret from the provider dashboard (never echoed back)"
  },
  "rawBody": {
   "type": "string",
   "description": "the raw webhook body exactly as received on the wire (signatures are over the raw bytes)"
  },
  "provider": {
   "type": "string",
   "description": "which provider signed the webhook: github | stripe | shopify | slack"
  },
  "signature": {
   "type": "string",
   "description": "the signature header value, with or without its scheme prefix (sha256= / v0= / t=...,v1=...)"
  },
  "timestamp": {
   "type": "string",
   "description": "the provider timestamp header - required for stripe/slack replay protection (stripe's may ride in the signature's t= element)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "args": {
   "secret": "gh_hook_secret_demo_only",
   "rawBody": "{\"ref\":\"refs/heads/main\",\"before\":\"6113728f27ae82c7b1a177c8d03f9e96e0adf246\",\"after\":\"d6fde92930d4715a2b49857d24b940956b26d2d3\",\"repository\":{\"full_name\":\"acme/checkout-service\"},\"pusher\":{\"name\":\"alice\",\"email\":\"alice@example.com\"},\"head_commit\":{\"id\":\"d6fde92930d4715a2b49857d24b940956b26d2d3\",\"message\":\"fix: retry payment capture on 5xx\",\"timestamp\":\"2026-07-01T15:04:05Z\"}}",
   "provider": "github",
   "signature": "sha256=45f74caa8f537323fd4fa022357ebc620cbcfb28a6dcd65b0f1da3646edf5c4a"
  },
  "pack": "webhook-intake",
  "steps": [
   {
    "ok": true,
    "slug": "webhook-verify",
    "result": {}
   },
   {
    "ok": true,
    "slug": "json-validate",
    "result": {}
   },
   {
    "ok": true,
    "slug": "hash",
    "result": {}
   },
   {
    "ok": true,
    "slug": "time-convert",
    "result": {}
   },
   {
    "ok": true,
    "slug": "redact",
    "result": {}
   }
  ],
  "summary": "5/5 steps succeeded"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent402-tools-webhook-secure-intake-34ef4b41/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)