Webhook Endpoints (Sources)

A webhook endpoint is the entry point for incoming webhooks. Each endpoint has a unique slug that forms its URL: POST /hooks/:slug.

Adding a Source

When you add a source, Dispatch generates:

• Slug — a URL-safe identifier (e.g., my-github-webhooks)
• Signing Secret — an HMAC secret for verifying request authenticity

Configuration Options

Field	Description
Name	Display name for the endpoint
Slug	URL path segment (auto-generated, can be customized)
Signing Secret	Secret used to verify incoming request signatures
Event Type Path	Dot-notation path to extract event type from the payload body (e.g., action or event.type)
Provider	Optional: github, gitlab, bitbucket, slack, jira, linear, or stripe for provider-specific behavior
Is Active	Toggle to enable/disable the endpoint

Ingress Throughput

Dispatch beats Hookdeck's flat 5 events/sec base rate at every plan. Caps apply per second and are enforced in two scopes — per endpoint URL and per project (sum across endpoints):

Plan	Per-URL	Per-Project
Free	60/sec	180/sec
Team	120/sec	360/sec
Growth	600/sec	1,800/sec

Integration endpoints are never rate-limited. If you installed an integration via Dispatch (GitHub, Stripe, Linear, Slack, Jira, Bitbucket, Confluence, Discord, Telegram, etc.) your webhook traffic passes through uncapped — Dispatch promises reliable handling.

For custom endpoints (where you give the URL to an arbitrary external service), the free plan returns 429 Too Many Requests with a Retry-After header when a cap is exceeded. Team and Growth plans never reject — overages are accepted and logged for visibility. See the API reference for response headers.

Event Type Extraction

Dispatch determines the event type from (in order of priority):

1. Provider-specific extraction — headers like X-GitHub-Event, X-Gitlab-Event, and Linear-Event, or payload fields like Stripe's type (e.g., payment_intent.succeeded) and Slack's event.type
2. The endpoint's configured event type header (a custom request header name)
3. The endpoint's configured event type path (dot-notation path into the JSON body)
4. The generic X-Event-Type header — honored on any endpoint, no configuration needed
5. The endpoint's typing rules — conditions over the payload and headers that assemble a type from literal and payload-path parts; the first rule that matches and derives a non-empty value wins (up to 10 rules per endpoint)

Explicit endpoint configuration (2–3) outranks the X-Event-Type convention, so a configured header or path always wins over what a sender happens to include.

The event type is stored with the event and can be used for filtering destinations by event type. Typing rules apply at ingest to new events only — already-stored events keep their type.

Signature Verification

All incoming requests must be authenticated using one of these methods:

HMAC Signature (Default)

Include an HMAC-SHA256 signature of the request body in one of these headers:

• X-Hub-Signature-256 (GitHub-compatible)
• X-Dispatch-Signature

Format: sha256=<hex-encoded-hmac>

# Generate signature
SIGNATURE=$(echo -n "$BODY" | openssl dgst -sha256 -hmac "$SIGNING_SECRET" | cut -d' ' -f2)

curl -X POST https://api.dispatch.tech/hooks/my-slug \
  -H "Content-Type: application/json" \
  -H "X-Dispatch-Signature: sha256=$SIGNATURE" \
  -d "$BODY"

Slack Signature

For Slack endpoints (provider = slack), Dispatch verifies the X-Slack-Signature header using the format:

v0:{timestamp}:{body}

The timestamp must be within 5 minutes of the current time to prevent replay attacks.

GitLab Token

For GitLab endpoints (provider = gitlab), Dispatch checks the X-Gitlab-Token header for a literal match against the endpoint's signing secret:

X-Gitlab-Token: your-signing-secret

Linear Signature

For Linear endpoints (provider = linear), Dispatch verifies the Linear-Signature header, which contains an HMAC-SHA256 hex digest of the request body:

Linear-Signature: <hex-encoded-hmac>

Stripe Signature

For Stripe endpoints (provider = stripe), set the endpoint's signing secret to your Stripe webhook signing secret (begins with whsec_). Dispatch verifies the Stripe-Signature header:

Stripe-Signature: t=...,v1=...

To get the signing secret, copy the Webhook signing secret from your Stripe Dashboard webhook endpoint configuration.

Jira / Confluence JWT

For Jira endpoints (provider = jira), Dispatch verifies the Authorization: Bearer <JWT> header included automatically by Jira when sending webhooks. When connecting via OAuth, Dispatch manages this automatically.

API Key

Include a project API key in the Authorization header:

Authorization: Bearer dsp_your-api-key

Endpoint-Destination Links

An endpoint can be linked to multiple destinations. Each link can have:

• An optional message template for formatting
• Routing rules for conditional template selection
• A JSONata transform applied before formatting

See Destinations, Templates, and Transforms for details.

Regenerating the Signing Secret

You can regenerate an endpoint's signing secret from the dashboard. This immediately invalidates the old secret — update your external service configuration before the next webhook is sent.

For zero-downtime rotation, rotate the secret through the API instead: the rotation request accepts an overlap window during which webhooks signed with either the previous or the new secret are accepted. The overlap applies to every source type that supports signature verification.

Deactivating an Endpoint

Setting an endpoint to inactive causes all incoming requests to that slug to return 404 Not Found. Existing events and delivery history are preserved.