Webhooks API

Alpha

DSAR is currently in alpha. APIs, package surfaces, configuration, and documentation may change as the project evolves.

These public endpoints accept inbound provider events and map them into DSAR intake flows.

POST /webhooks/inbound/resend

Receive a Resend inbound webhook event.

This endpoint is public in the HTTP contract so webhook providers can call it without a DSAR bearer token.

Callers still need to satisfy the provider signature-verification requirements. See the related integration guide for the exact header and secret handling details. Resend uses svix headers and Slack uses signing-secret verification.

Request body:

created_at (string, required): provider timestamp
type (string, required): provider event type
data (unknown, required): raw provider payload

Response (202):

{
	"id": "req-123",
	"jurisdiction": "eu",
	"receivedAt": "2026-01-01T00:00:00.000Z",
	"sourceId": "resend-message-id",
	"status": "captured",
	"tenantId": "tenant-1",
	"workspaceId": "workspace-1"
}

Possible status values:

"captured" when DSAR created or matched a request flow
"ignored_non_dsar" when the inbound event is not treated as DSAR intake

POST /webhooks/inbound/slack

Receive a Slack inbound webhook event.

This endpoint is also public in the HTTP contract.

Request body: Raw Slack webhook payload.

Responses:

URL verification challenge:

{
	"challenge": "slack-challenge-token"
}

Accepted DSAR or ignored event:

{
	"callbackId": "cb-123",
	"channelId": "C123",
	"id": "req-123",
	"reason": "matched_subject_request",
	"sourceId": "slack-event-id",
	"status": "captured",
	"surface": "inbound_slack",
	"teamId": "T123"
}

Related guides: