> ## Documentation Index
> Fetch the complete documentation index at: https://docs.linquid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Inbound Webhook Receivers

> Provider callback receivers for Stripe, Shopify, HubSpot, Slack, and Zapier automation

# Inbound Webhook Receivers

These routes receive events from external systems and convert them into Linquid actions (conversions, notifications, automations, and data sync).

## Provider webhook routes

### Stripe integration callbacks

* `POST /api/integrations/webhooks/stripe`

Expected query context includes installation ID; signature verification is enforced and idempotency records are used.

### Shopify callbacks

* `POST /api/integrations/webhooks/shopify`

Handles Shopify order/checkout signals for conversion attribution and customer mapping.

### HubSpot callbacks

* `POST /api/integrations/webhooks/hubspot/:installationId`
* `POST /api/integrations/webhooks/hubspot`

Validates HubSpot signatures and processes contact/deal lifecycle events.

### Slack callbacks

* `POST /api/integrations/webhooks/slack/events`
* `POST /api/integrations/webhooks/slack/commands`
* `POST /api/integrations/webhooks/slack/notify/:installationId`

Includes Slack signature verification and slash command handling.

### Zapier automation endpoints

* `POST /api/integrations/webhooks/zapier/subscribe`
* `DELETE /api/integrations/webhooks/zapier/subscribe/:id`
* `GET /api/integrations/webhooks/zapier/sample/:event`
* `GET /api/integrations/webhooks/zapier/perform-list/links`
* `GET /api/integrations/webhooks/zapier/perform-list/campaigns`
* `GET /api/integrations/webhooks/zapier/events`
* `POST /api/integrations/webhooks/zapier/test`

Zapier endpoints authenticate via API key bearer token and enforce required webhook/link scopes.

## Security model

* Provider receivers do not use dashboard session CSRF flow.
* Each provider route validates signatures/tokens using provider-specific mechanisms.
* Unknown or invalid installations/signatures are rejected before processing.

## Processing behavior

* Handlers write idempotency/event logs where applicable.
* Successful processing can create conversion/customer side effects and downstream webhook publications.
* Failures are surfaced as provider callback errors and/or installation error state updates.