Vortex billing webhook receiver. Auth is the Vortex-Signature header (HMAC-SHA256 over the raw body) — no org principal. Subscription and entitlement lifecycle events flip the org's plan state; unknown event types are durable no-ops. Not MCP.

POST/v1/billing/webhook

Header parameters

Vortex-Signaturestringrequired

t=<ms>,v1=<hex-hmac>

Request body

requiredapplication/json

object

Responses

204accepted (or durable no-op)

400malformed event body

401missing or invalid signature

404billing webhook not configured

413body too large

Request

curl -X POST "https://veil.nyc/v1/billing/webhook" \
  -H "Vortex-Signature: string" \
  -H "Content-Type: application/json" \
  -d '{}'

const response = await fetch("https://veil.nyc/v1/billing/webhook", {
  method: "POST",
  headers: {
    "Vortex-Signature": "string",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({})
});

import requests

response = requests.post(
    "https://veil.nyc/v1/billing/webhook",
    headers={
        "Vortex-Signature": "string",
        "Content-Type": "application/json"
    },
    json={},
)

Response

accepted (or durable no-op)