Inbound endpoints

Give any system a URL it can post JSON to, and choose what each post does.

Updated 23 September 2026

On this page

Why: Plenty of systems can send an HTTP post but cannot hold a key or read an API.
What: A tokenised URL under /api/in/ that accepts JSON and does one action.
How: Create it on Custom inbound endpoint, pick the action and point your sender at the URL.

Create one

Step 1.
In /app/settings/integrations, open Custom inbound endpoint and choose New endpoint. It needs the admin role.
Step 2.
Name it, choose the Action and, if the sender can set a header, tick Require a signature.
Step 3.
Choose Create endpoint, then copy the URL and the Secret. The secret is shown once.

Actions

Action	Body	What happens
Create request	`{ text, title?, customer?: { company?, email? }, external_ref? }`	Each post opens a request in the AI area, ready to answer.
Upsert customers	`{ customers: [{ company, email?, phone?, external_id? }] }`, up to 500	Create or update customers matched by external id or email domain.
Upsert products	`{ products: [...], schema_id? }`, up to 1,000	Create or update catalogue products by SKU, with the same validation as the import wizard.
ERP order status	`{ quote_ref?, order_ref?, status, tracking_url? }`	An ERP such as EFACS posts an order status update; the matched order moves with it.
Order invoice	`{ order_ref?, quote_ref?, invoice_ref, invoice_status?, amount_minor?, currency? }`	Your accounting system posts the invoice it raised. Wire it from Xero, QuickBooks or Sage through the automation you already run; Kabaido records the reference, it never issues an invoice.
Purchase order acknowledgement	`{ po_number, supplier_ref?, lines?: [{ position?, expected_date }] }`	A supplier or a broker posts our purchase order number, their reference and confirmed dates; the order moves to acknowledged.
Supplier invoice	`{ po_number, invoice_ref, amount_minor?, currency?, invoiced_qty? }`	Your accounting system posts the supplier's invoice against our purchase order number; the three way match runs and a variance is raised where it does not agree.
Delivery status	`{ delivery_ref?, consignment_ref?, order_ref?, status, tracking_url? }`	A carrier account, an aggregator or an ERP posts what happened to a consignment, matched by the delivery number, the consignment reference or the order. The delivery moves, the tracking address is stored on it and the order follows.

Example

bash

curl -X POST https://kabaido.ai/api/in/whin_your_token \
  -H "Content-Type: application/json" \
  -d '{ "text": "RFQ: 25 off 12 mm carbide end mills, 4 flute", "external_ref": "WEB-2291" }'

Signatures

With Require a signature on, send X-Kabaido-Signature built exactly as webhook signatures are, with the endpoint's secret and a timestamp within five minutes. Without it, the token in the URL is the only credential: treat the URL like a password.

Responses

Status	Means
200	Done; the body summarises what changed
202	Accepted: a request was opened, or nothing matched yet
400	The body is not valid JSON or not the action's shape
401	A signature is required and is missing or wrong
404	No endpoint has that token
402	An upsert of products would pass your plan's product cap
409	The endpoint is paused, or the record cannot move that way
413	The body is over 1MB
422	Understood but not applicable: an unknown status, an invoice that does not fit, or no owner to attribute a request to
429	Too many posts at once; see rate limits
500	A fault on our side; retry later

Every post that reaches the action, accepted or rejected, appears under Recent receipts on the endpoint, so a sender posting the wrong shape shows up in Settings. Untick Active to pause a sender that has gone wrong; deleting the endpoint destroys the token for good.

PreviousWebhooks NextThe MCP server