Inbound endpoints
Give any system a URL it can post JSON to: open requests, upsert customers or products.
An inbound endpoint is a tokenised URL that accepts HTTP POST with a JSON body. Create one in Settings, then Integrations, under Custom inbound endpoint, choose its action and Kabaido shows the URL and a signing secret once. Pausing or deleting the endpoint revokes the URL immediately.
Actions
| Action | Body | Result |
|---|---|---|
| Create request | { text, title?, customer?, external_ref? } | Opens a request thread your team sees in Requests; responds 202 with the request id |
| Upsert customers | { customers: [{ company, email?, phone?, external_id? }] } | Creates or updates up to 500 customers, matched by external id then email domain |
| Upsert products | { products: [...], schema_id? } | Creates or updates up to 1000 products by SKU, same validation as the import wizard |
Example
curl https://kabaido.ai/api/in/whin_your_token \
-H "Content-Type: application/json" \
-d '{ "text": "RFQ: 25x 12mm carbide end mills, 4 flute, AlTiN" }'Signatures and limits
When the endpoint requires signatures, send X-Kabaido-Signature computed exactly like outbound webhook signatures, keyed by the endpoint secret over the raw body. Leave verification off for senders that cannot set headers; the token in the URL is then the only credential, so share it carefully. Bodies are limited to 1MB and each endpoint is throttled to short bursts of up to 120 posts.
Every receipt appears under the endpoint in Settings with its outcome, so a misconfigured sender is visible immediately.
When to use one instead of the API
The REST API is the better tool when the system doing the sending can be programmed properly: it can hold a key, handle a 4xx, page a list and read a response. An inbound endpoint is for everything else, and there is a lot of everything else in an industrial business.
- A form on your own website that needs to raise a request without anyone writing a backend for it.
- An automation tool such as Zapier, Make or n8n, where a URL and a JSON body is the whole vocabulary available.
- An ERP or MRP whose only outbound facility is a scheduled HTTP post.
- A script somebody in the office wrote that has to keep working after they leave.
The trade is deliberate: the token in the URL is the credential, so an endpoint is easier to set up and easier to leak. Turn signature verification on wherever the sender can set a header, and treat an endpoint URL as you would a password when it cannot.
What comes back
A create request responds 202 with the request id, because the reading happens afterwards rather than while your sender waits. The upsert actions respond once the records are written. Either way the receipt is recorded against the endpoint, so a sender quietly posting malformed JSON is visible in Settings rather than only in its own logs.
Pausing an endpoint is the fastest way to stop a sender that has gone wrong. It revokes the URL immediately and keeps the configuration, so you can turn it back on once the sender is fixed rather than setting the whole thing up again.