---
title: "Receive an aggregator webhook"
method: POST
path: "/v1/discovery/webhooks/{provider}/{webhookToken}"
tags: ["Discovery"]
---

# Receive an aggregator webhook

`POST /v1/discovery/webhooks/{provider}/{webhookToken}`

Receives a Pluggy/Belvo aggregator webhook and asynchronously pulls the signaled data into the ingestion pipeline. This route carries no operator JWT. It is authenticated by an opaque token in the URL path (resolved to a tenant binding server-side, never claimed) PLUS a per-provider source check: a valid HMAC-SHA256 of the raw body in the X-Webhook-Signature header, OR membership in the provider's source-IP allowlist. Both layers fail closed; the tenant is derived solely from the resolved token binding.

## Path parameters

- `provider` string, required — Aggregator provider the token was minted for (pluggy or belvo)
- `webhookToken` string, required — Opaque webhook token minted for the connection; hashed and resolved to a tenant binding server-side

## Headers

- `X-Webhook-Signature` string — Hex HMAC-SHA256 of the raw body for signing providers; omitted by IP-allowlist providers

## Response `202`

Accepted

## Other responses

- `default` — Error

---

[API](https://skmtc.net/lerian/apis/identity-plugin.md) · [All operations](https://skmtc.net/lerian/apis/identity-plugin/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lerian/identity-plugin/versions/25daba385532/schema)