Webhooks

{
  "id": "evt_01h...",
  "type": "decision.created",
  "created": "2026-04-29T20:00:00Z",
  "workspace_id": "d85d7e6f-58f2-4637-b3a0-3cf2c3b8a638",
  "data": {
    "id": "dec_123",
    "title": "Campaign brief ready",
    "urgency": "high"
  }
}

X-OrgX-Signature: sha256=...

export async function POST(request: Request) {
  const signature = request.headers.get('x-orgx-signature');
  const body = await request.text();

  if (!signature || !verifyOrgxSignature(body, signature)) {
    return new Response('invalid signature', { status: 401 });
  }

  const event = JSON.parse(body);
  await processOrgxEvent(event);

  return Response.json({ received: true });
}