Support/Developer Platform/Inbound endpoints
/

Developer Platform

Inbound endpoints

Create app-bound inbound entry points, rotate keys, and process incoming events through authenticated application APIs.

Scope
inbound.write
Identity
Server-derived app
Rotation
Explicit endpoint operation

Inbound endpoints give an external system a controlled entry point into one SaaS app. The platform authenticates, validates, and routes each accepted event through its application service contracts.

Current operations

GET  /v1/apps/{saasAppId}/inbound-endpoints
POST /v1/apps/{saasAppId}/inbound-endpoints
POST /v1/apps/{saasAppId}/inbound-endpoints/{endpointId}/rotate

The authenticated credential establishes the app boundary. A path ID selects an endpoint inside that boundary; it does not grant access to an endpoint owned by another app.

Key handling

Treat an endpoint key like any other integration secret: capture it only from the authorized create/rotate response, store it in a secret manager, and rotate it immediately after suspected disclosure. Never place it in source control, URLs, screenshots, or browser bundles.

Processing model

Validate and acknowledge inbound requests quickly, then perform durable work asynchronously. Use stable external event IDs where the source provides them so retries do not create duplicate business activity.

Tip

Document the source system, owning team, rotation owner, and last tested date for every inbound endpoint. An unlabeled endpoint becomes an incident during the first key rotation.