---
title: "Receive Hook"
method: POST
path: "/api/v1/hooks/{session_id}"
---

# Receive Hook

`POST /api/v1/hooks/{session_id}`

Receive a hook event from Claude Code.

Claude Code sends structured JSON with at minimum a ``hook_event_name``
field.  The event is parsed, persisted to a JSONL sidecar, and triggers
side effects (heartbeat touch, completion markers, etc.).

The request body is verified against
``X-Bernstein-Hook-Signature-256`` (HMAC-SHA256 over the raw body,
keyed with ``BERNSTEIN_HOOK_SECRET``) *before* any parsing or
filesystem work - this is the authentication boundary for the
endpoint. The ``session_id`` is then validated against
a strict allowlist to prevent path traversal.

Args:
    session_id: Agent session identifier from the URL path.
    request: The incoming FastAPI request.

Returns:
    JSON response with status and action taken, 401 if signature
    verification fails, or 400 if ``session_id`` is unsafe / body
    is not valid JSON.

## Path parameters

- `session_id` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/sipyourdrink-ltd/apis/bernstein-task-server.md) · [All operations](https://skmtc.net/sipyourdrink-ltd/apis/bernstein-task-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sipyourdrink-ltd/bernstein-task-server/revisions/86f514b4e920/schema)