Ingest HTTP webhook events

Any service that can send an HTTP request becomes a source. ingestlayer generates an ingest URL — https://in.ingestlayer.com/whk/<token> — and every POST to it becomes one event. Classify, enrich, and redact in flight first — then fan out to any destination, with retries and a dead-letter queue behind every delivery.

how events arrive

01
create the endpoint
Add an HTTP webhook source. ingestlayer generates a unique URL of the form https://in.ingestlayer.com/whk/<token> that accepts any HTTP POST.
02
choose auth
HMAC signing (the default) or a bearer token. In signed mode the sender includes an X-Ingest-Signature header — the hex HMAC-SHA256 of the raw body — which ingestlayer recomputes and compares in constant time, rejecting anything that doesn't match. An unauthenticated mode exists for local testing.
03
send your events
POST JSON to the URL. The body becomes the event payload; if it carries a string `type` that becomes the event type, otherwise ingestlayer stamps webhook.in.received. Rename or reshape fields with the transform action downstream.

from http webhookdelivered

POST /whk/wh_3f8a HTTP/1.1
Host: in.ingestlayer.com
Content-Type: application/json
X-Ingest-Signature: 9f86d081884c…

{
  "type":     "order.created",
  "order_id": "ord_18f2",
  "amount":   4200,
  "currency": "eur",
  "email":    "ada@acme.com"
}

notes

HMAC mode verifies one scheme: the hex HMAC-SHA256 of the body in X-Ingest-Signature. A sender that signs with its own scheme — a timestamped t=…,v1= signature, say — won't validate against it; use bearer auth for those until a native source for them ships.
Send an X-Ingest-Idempotency-Key header so a sender's retry counts once — ingest is deduplicated on it.
Each source has its own rate limit. Over the limit, ingestlayer replies 429 with a Retry-After header, so the sender backs off and retries rather than losing the event.

Ingest HTTP webhook events

how events arrive

notes

route HTTP webhook anywhere