Bernstein Webhooks API

openapi: 3.2.0
info:
  title: Bernstein Task Server Webhooks API
  description: 'Bernstein REST API - the open-source governance layer for AI agents, one git worktree per task.


    ## Authentication


    Authentication is ENABLED by default. Include a Bearer token in all requests:


    ```

    Authorization: Bearer

    ```


    To run without auth (development only), set `BERNSTEIN_AUTH_DISABLED=1` - this logs a loud warning and passes every request through.


    Public endpoints (no auth required): `/health`, `/health/ready`, `/health/live`, `/ready`, `/alive`, `/.well-known/agent.json`, `/docs`, `/openapi.json`, and the auth-flow endpoints (`/auth/login`, `/auth/oidc/callback`, etc.).


    Webhook and hook endpoints (`/webhook`, `/webhooks/*`, `/hooks/{session_id}`) authenticate via HMAC-SHA256 signatures - they do NOT accept Bearer tokens.


    ## Base URL


    Default: `http://127.0.0.1:8052`. Override with env vars `BERNSTEIN_HOST` and `BERNSTEIN_PORT`.


    ## Error Format


    All errors return JSON with a `detail` field:


    ```json

    {"detail": "Task not found: task-xyz"}

    ```


    | Status | Meaning |

    |--------|---------|

    | 400 | Bad request (validation error) |

    | 401 | Unauthorized (missing/invalid token) |

    | 403 | Forbidden (IP not in allowlist) |

    | 404 | Resource not found |

    | 409 | Conflict (task already in terminal state) |

    | 429 | Rate limited - respect the `Retry-After` header |

    | 500 | Internal server error |'
  version: 3.22.0
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  contact:
    name: Alex Chernysh
    url: https://github.com/sipyourdrink-ltd/bernstein
servers:
- url: http://{host}:{port}
  description: Task server started by the Bernstein CLI on the operator's own machine. There is no hosted instance; substitute the host and port of your install.
  variables:
    host:
      default: 127.0.0.1
      description: Interface the task server binds to. Loopback by default.
    port:
      default: '8052'
      description: Task server port. Override with BERNSTEIN_PORT.
tags:
- name: Webhooks
paths:
  /webhooks/github:
    post:
      summary: Github Webhook
      description: 'Receive a GitHub App webhook, verify signature, and create tasks.


        Handles the following event types:

        - ``issues`` (opened / labeled)

        - ``pull_request_review_comment`` / ``issue_comment``

        - ``push``

        - ``workflow_run`` (completed + failure) - creates a ci-fix task, capped at

        ``MAX_CI_RETRIES`` active attempts per branch.


        Reads ``GITHUB_WEBHOOK_SECRET`` from environment for HMAC verification.

        Fail-closed: when the secret is not configured the

        endpoint is disabled and returns 503; unsigned GitHub webhooks are

        never accepted.

        Replay protection: if the caller includes an

        ``X-Bernstein-Timestamp`` header the request is additionally

        checked for freshness - drift greater than five minutes returns

        401. Real GitHub deliveries omit this header and continue to

        work; the check is there so bernstein-internal relays cannot be

        replayed after capture.

        Returns 200 on success, 401 on bad/missing signature or stale

        timestamp, 400 on parse error, 503 when the endpoint is not

        configured.'
      operationId: github_webhook_webhooks_github_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /webhooks/gitlab:
    post:
      summary: Gitlab Webhook
      description: 'Receive a GitLab CI webhook, verify token, and create ci-fix tasks.


        Handles the following event types:

        - ``pipeline`` (failed) - creates a ci-fix task, capped at

        ``MAX_CI_RETRIES`` active attempts per branch.

        - ``job`` (failed) - creates a ci-fix task for the specific job.


        Reads ``GITLAB_WEBHOOK_TOKEN`` from environment. GitLab sends a simple

        plaintext token in the ``x-gitlab-token`` header.

        Returns 200 on success, 401 on bad/missing token.'
      operationId: gitlab_webhook_webhooks_gitlab_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /webhooks/telemetry/sentry/:
    post:
      summary: Telemetry Sentry
      description: Receive a Sentry-protocol issue-alert webhook.
      operationId: telemetry_sentry_webhooks_telemetry_sentry__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /webhooks/telemetry/gha_failure/:
    post:
      summary: Telemetry Gha Failure
      description: Receive a GitHub Actions ``workflow_run`` failure webhook.
      operationId: telemetry_gha_failure_webhooks_telemetry_gha_failure__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /webhooks/telemetry/datadog/:
    post:
      summary: Telemetry Datadog
      description: Receive a Datadog Logs webhook (stubbed in MVP).
      operationId: telemetry_datadog_webhooks_telemetry_datadog__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /webhooks/telemetry/loki/:
    post:
      summary: Telemetry Loki
      description: Receive a Loki / Alertmanager webhook (stubbed in MVP).
      operationId: telemetry_loki_webhooks_telemetry_loki__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /webhooks/telemetry/custom_jsonl/:
    post:
      summary: Telemetry Custom Jsonl
      description: Receive a custom JSONL tail webhook (stubbed in MVP).
      operationId: telemetry_custom_jsonl_webhooks_telemetry_custom_jsonl__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /webhooks/trackers/{adapter}:
    post:
      summary: Tracker Webhook
      description: 'Receive a tracker webhook, verify, dedupe, and enqueue.


        Path parameter:

        adapter: Short adapter name registered via

        :func:`bernstein.core.trackers.webhook_receiver.register_handler`.


        The endpoint accepts any JSON object. All verification and replay

        decisions are made before the body is enqueued. When verification

        succeeds and the delivery is fresh the parsed

        :class:`~bernstein.core.trackers.webhook_receiver.TrackerEvent` is

        stashed on ``app.state.tracker_event_queue`` if present so the

        orchestrator''s normal task ingestion can drain it; if no queue is

        wired we simply log the event. Either way the tracker receives a

        200 so it does not retry.'
      operationId: tracker_webhook_webhooks_trackers__adapter__post
      parameters:
      - name: adapter
        in: path
        required: true
        schema:
          type: string
          title: Adapter
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - Webhooks
  /webhooks/discord/interactions:
    post:
      summary: Discord Interactions
      description: 'Receive and route Discord Application Command interactions.


        Verifies the Ed25519 signature, handles PING handshakes, and dispatches

        slash commands to the appropriate handler. Returns an immediate response

        (Discord requires a reply within 3 seconds).


        Returns:

        200 with a Discord interaction response object on success.

        401 if the signature is invalid.

        400 if the payload cannot be parsed.'
      operationId: discord_interactions_webhooks_discord_interactions_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /webhooks/slack/commands:
    post:
      summary: Slack Slash Command
      description: 'Receive a Slack slash command, verify signature, and ack immediately.


        Slack requires a response within 3 seconds. This endpoint verifies the

        request signature, parses the URL-encoded form payload, and returns an

        immediate acknowledgement. Any long-running work (task creation, etc.)

        should be dispatched asynchronously using ``response_url``.


        Reads ``SLACK_SIGNING_SECRET`` from environment for HMAC verification.

        The secret MUST be configured: when it is not, the endpoint is

        disabled and returns ``UNCONFIGURED_STATUS``; only signed Slack

        requests are accepted.

        Returns 200 on success, 401 on bad/missing signature, 400 on parse

        error, ``UNCONFIGURED_STATUS`` when the endpoint is not configured.


        Slash command form fields parsed:

        - ``command`` - the slash command (e.g. ``/bernstein``)

        - ``text`` - text following the command

        - ``user_id`` - Slack user ID

        - ``channel_id`` - Slack channel ID

        - ``response_url`` - URL for delayed responses (up to 30 min)

        - ``trigger_id`` - trigger ID for opening modals'
      operationId: slack_slash_command_webhooks_slack_commands_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /webhooks/slack/events:
    post:
      summary: Slack Events
      description: 'Receive Slack Events API callbacks.


        Handles:

        - ``url_verification``: returns the challenge value for endpoint verification.

        - ``event_callback`` with ``message`` type: creates a task when the bot is

        mentioned. Bot messages and ``message_changed`` subtypes are ignored to

        prevent loops.


        Reads ``SLACK_SIGNING_SECRET`` from environment for HMAC verification.

        The secret MUST be configured: when it is not, the endpoint is

        disabled and returns ``UNCONFIGURED_STATUS``; only signed Slack

        requests are accepted. Note that the ``url_verification`` handshake

        is signed by Slack too, so registering the endpoint works normally.

        Payload shape is validated before it is read: the body and, when

        present, its ``event`` member must both be JSON objects.

        Returns 200 on success, 401 on bad/missing signature, 400 on parse

        error or malformed payload shape, ``UNCONFIGURED_STATUS`` when the

        endpoint is not configured.'
      operationId: slack_events_webhooks_slack_events_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/github:
    post:
      summary: Github Webhook
      description: 'Receive a GitHub App webhook, verify signature, and create tasks.


        Handles the following event types:

        - ``issues`` (opened / labeled)

        - ``pull_request_review_comment`` / ``issue_comment``

        - ``push``

        - ``workflow_run`` (completed + failure) - creates a ci-fix task, capped at

        ``MAX_CI_RETRIES`` active attempts per branch.


        Reads ``GITHUB_WEBHOOK_SECRET`` from environment for HMAC verification.

        Fail-closed: when the secret is not configured the

        endpoint is disabled and returns 503; unsigned GitHub webhooks are

        never accepted.

        Replay protection: if the caller includes an

        ``X-Bernstein-Timestamp`` header the request is additionally

        checked for freshness - drift greater than five minutes returns

        401. Real GitHub deliveries omit this header and continue to

        work; the check is there so bernstein-internal relays cannot be

        replayed after capture.

        Returns 200 on success, 401 on bad/missing signature or stale

        timestamp, 400 on parse error, 503 when the endpoint is not

        configured.'
      operationId: github_webhook_api_v1_webhooks_github_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/gitlab:
    post:
      summary: Gitlab Webhook
      description: 'Receive a GitLab CI webhook, verify token, and create ci-fix tasks.


        Handles the following event types:

        - ``pipeline`` (failed) - creates a ci-fix task, capped at

        ``MAX_CI_RETRIES`` active attempts per branch.

        - ``job`` (failed) - creates a ci-fix task for the specific job.


        Reads ``GITLAB_WEBHOOK_TOKEN`` from environment. GitLab sends a simple

        plaintext token in the ``x-gitlab-token`` header.

        Returns 200 on success, 401 on bad/missing token.'
      operationId: gitlab_webhook_api_v1_webhooks_gitlab_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/telemetry/sentry/:
    post:
      summary: Telemetry Sentry
      description: Receive a Sentry-protocol issue-alert webhook.
      operationId: telemetry_sentry_api_v1_webhooks_telemetry_sentry__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/telemetry/gha_failure/:
    post:
      summary: Telemetry Gha Failure
      description: Receive a GitHub Actions ``workflow_run`` failure webhook.
      operationId: telemetry_gha_failure_api_v1_webhooks_telemetry_gha_failure__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/telemetry/datadog/:
    post:
      summary: Telemetry Datadog
      description: Receive a Datadog Logs webhook (stubbed in MVP).
      operationId: telemetry_datadog_api_v1_webhooks_telemetry_datadog__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/telemetry/loki/:
    post:
      summary: Telemetry Loki
      description: Receive a Loki / Alertmanager webhook (stubbed in MVP).
      operationId: telemetry_loki_api_v1_webhooks_telemetry_loki__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/telemetry/custom_jsonl/:
    post:
      summary: Telemetry Custom Jsonl
      description: Receive a custom JSONL tail webhook (stubbed in MVP).
      operationId: telemetry_custom_jsonl_api_v1_webhooks_telemetry_custom_jsonl__post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/trackers/{adapter}:
    post:
      summary: Tracker Webhook
      description: 'Receive a tracker webhook, verify, dedupe, and enqueue.


        Path parameter:

        adapter: Short adapter name registered via

        :func:`bernstein.core.trackers.webhook_receiver.register_handler`.


        The endpoint accepts any JSON object. All verification and replay

        decisions are made before the body is enqueued. When verification

        succeeds and the delivery is fresh the parsed

        :class:`~bernstein.core.trackers.webhook_receiver.TrackerEvent` is

        stashed on ``app.state.tracker_event_queue`` if present so the

        orchestrator''s normal task ingestion can drain it; if no queue is

        wired we simply log the event. Either way the tracker receives a

        200 so it does not retry.'
      operationId: tracker_webhook_api_v1_webhooks_trackers__adapter__post
      parameters:
      - name: adapter
        in: path
        required: true
        schema:
          type: string
          title: Adapter
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      tags:
      - Webhooks
  /api/v1/webhooks/discord/interactions:
    post:
      summary: Discord Interactions
      description: 'Receive and route Discord Application Command interactions.


        Verifies the Ed25519 signature, handles PING handshakes, and dispatches

        slash commands to the appropriate handler. Returns an immediate response

        (Discord requires a reply within 3 seconds).


        Returns:

        200 with a Discord interaction response object on success.

        401 if the signature is invalid.

        400 if the payload cannot be parsed.'
      operationId: discord_interactions_api_v1_webhooks_discord_interactions_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/slack/commands:
    post:
      summary: Slack Slash Command
      description: 'Receive a Slack slash command, verify signature, and ack immediately.


        Slack requires a response within 3 seconds. This endpoint verifies the

        request signature, parses the URL-encoded form payload, and returns an

        immediate acknowledgement. Any long-running work (task creation, etc.)

        should be dispatched asynchronously using ``response_url``.


        Reads ``SLACK_SIGNING_SECRET`` from environment for HMAC verification.

        The secret MUST be configured: when it is not, the endpoint is

        disabled and returns ``UNCONFIGURED_STATUS``; only signed Slack

        requests are accepted.

        Returns 200 on success, 401 on bad/missing signature, 400 on parse

        error, ``UNCONFIGURED_STATUS`` when the endpoint is not configured.


        Slash command form fields parsed:

        - ``command`` - the slash command (e.g. ``/bernstein``)

        - ``text`` - text following the command

        - ``user_id`` - Slack user ID

        - ``channel_id`` - Slack channel ID

        - ``response_url`` - URL for delayed responses (up to 30 min)

        - ``trigger_id`` - trigger ID for opening modals'
      operationId: slack_slash_command_api_v1_webhooks_slack_commands_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
  /api/v1/webhooks/slack/events:
    post:
      summary: Slack Events
      description: 'Receive Slack Events API callbacks.


        Handles:

        - ``url_verification``: returns the challenge value for endpoint verification.

        - ``event_callback`` with ``message`` type: creates a task when the bot is

        mentioned. Bot messages and ``message_changed`` subtypes are ignored to

        prevent loops.


        Reads ``SLACK_SIGNING_SECRET`` from environment for HMAC verification.

        The secret MUST be configured: when it is not, the endpoint is

        disabled and returns ``UNCONFIGURED_STATUS``; only signed Slack

        requests are accepted. Note that the ``url_verification`` handshake

        is signed by Slack too, so registering the endpoint works normally.

        Payload shape is validated before it is read: the body and, when

        present, its ``event`` member must both be JSON objects.

        Returns 200 on success, 401 on bad/missing signature, 400 on parse

        error or malformed payload shape, ``UNCONFIGURED_STATUS`` when the

        endpoint is not configured.'
      operationId: slack_events_api_v1_webhooks_slack_events_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      tags:
      - Webhooks
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError