Ingest
The inbound Column webhook.
Column delivers events here, one endpoint per program. The raw body is verified against the program's signing secret (Column-Signature, HMAC-SHA256 hex); an invalid signature stores nothing. Deduplicated by event id, safe under redelivery, answered inside the 10-second budget; scoring, detection and triage run after the response.
ColumnEvent
| Field | Type | Notes |
|---|---|---|
| id | string | Column event id; redeliveries carry the same id and are deduplicated. |
| created_at | string | |
| type | string | e.g. ach.outgoing_transfer.returned |
| data (optional) | object | The bank's object. |
Endpoints
post/webhooks/column/{key}
Receive a Column event
Raw body, 2 MB limit, any content type. Verified before anything is parsed; stored, deduplicated by event id, answered at once. Writes are awaited; scoring, detection and triage run after the response. Column registers this URL itself when a tenant connects its key.
| Auth | None (public) |
|---|---|
| Operation | Ingest · POST /webhooks/column/{key} |
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
| key | path | string | The program slug (or the Column webhook endpoint id). |
| Column-Signature | header | string | HMAC-SHA256 of the raw body with the program's webhook secret, hex. |
| Webhook-Endpoint-Id (optional) | header | string | Column's endpoint id; resolves the program before the path key. |
Request body (application/json, required) · ColumnEvent
| Field | Type | Notes |
|---|---|---|
| id | string | Column event id; redeliveries carry the same id and are deduplicated. |
| created_at | string | |
| type | string | e.g. ach.outgoing_transfer.returned |
| data (optional) | object | The bank's object. |
Responses
200 — Stored (or a redelivery). object
| Field | Type | Notes |
|---|---|---|
| received | boolean | |
| duplicate | boolean |
400 — Invalid JSON or an event without id, created_at and type. Error
| Field | Type | Notes |
|---|---|---|
| error | string | What went wrong, in one sentence. |
| requestId (optional) | string | Present once the gateway is live: the X-Request-Id of the failed request. |
401 — Invalid signature; nothing stored. Error
| Field | Type | Notes |
|---|---|---|
| error | string | What went wrong, in one sentence. |
| requestId (optional) | string | Present once the gateway is live: the X-Request-Id of the failed request. |
404 — Unknown program. Error
| Field | Type | Notes |
|---|---|---|
| error | string | What went wrong, in one sentence. |
| requestId (optional) | string | Present once the gateway is live: the X-Request-Id of the failed request. |
Example
curl -s -X POST "https://skoor.ai/risk/webhooks/column/northwind-payroll" \
-H "Content-Type: application/json" \
-d '{"id":"evnt_2Zx9…","created_at":"2026-09-17T12:00:00Z","type":"ach.outgoing_transfer.returned","data":{"id":"acht_…","return_details":[{"return_code":"R10"}]}}'
Column signs the body; a hand-made call needs the program's secret: -H "Column-Signature: $(printf %s "$BODY" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | sed 's/^.* //')".