Webhook policy source (#7051)

# Description of Changes
Create custom webhooks as a source, allows file pushes toa custom made
endpoint with custom auth ID

- Adds webhook as a policy source: external systems push documents to a
receiver endpoint, which stages the files locally and triggers the
policy run
- Requests are authenticated with HMAC signatures; receiver hardened
with bounded body reads and server-minted IDs
- Uses the same team-scoped IntegrationConfig connection model as the S3
source, with matching portal UI (source type, icon, wizard)
- Includes a policies-gated Cucumber feature covering the receiver
end-to-end

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -249,6 +249,8 @@ public class ApplicationProperties {
          * in-network object store.
          */
         private boolean allowPrivateS3Endpoints = false;
+
+        private long webhookMaxBytes = 104857600L;
     }
 
     @Data

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -202,6 +202,7 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith("/readiness")
                 || trimmedUri.startsWith(
                         "/api/v1/mobile-scanner/") // Mobile scanner endpoints (no auth)
+                || trimmedUri.startsWith("/api/v1/webhooks/")
                 || trimmedUri.startsWith("/v1/api-docs")
                 // Workflow participant endpoints - access controlled by share tokens, not login
                 || trimmedUri.startsWith("/api/v1/workflow/participant/")

app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java

@@ -176,6 +176,13 @@ class RequestUriUtilsTest {
         assertFalse(RequestUriUtils.isPublicAuthEndpoint("/api/v1/convert", ""));
     }
 
+    @Test
+    void testIsPublicAuthEndpoint_webhookReceiver() {
+        // The webhook source receiver authenticates each delivery by HMAC signature, not a session.
+        assertTrue(RequestUriUtils.isPublicAuthEndpoint("/api/v1/webhooks/whk_abc123", ""));
+        assertTrue(RequestUriUtils.isPublicAuthEndpoint("/app/api/v1/webhooks/whk_abc123", "/app"));
+    }
+
     @Test
     void testIsPublicAuthEndpoint_withContextPath() {
         assertTrue(RequestUriUtils.isPublicAuthEndpoint("/app/login", "/app"));

app/proprietary/src/main/java/stirling/software/proprietary/policy/input/InputSource.java

@@ -3,6 +3,7 @@ package stirling.software.proprietary.policy.input;
 import java.io.IOException;
 import java.nio.file.Path;
 import java.util.List;
+import java.util.Map;
 
 import stirling.software.proprietary.policy.model.InputSpec;
 
@@ -22,6 +23,11 @@ public interface InputSource {
     /** Throws {@link IllegalArgumentException} on bad config. Called on save to fail fast. */
     default void validate(InputSpec spec) {}
 
+    default Map<String, Object> prepareOptionsForSave(
+            Map<String, Object> options, boolean isCreate) {
+        return options;
+    }
+
     /**
      * Resolve the spec into zero or more units of work, each carrying one run's files and a
      * completion hook. Empty list means nothing to run right now. Discovery is read-only - files

app/proprietary/src/main/java/stirling/software/proprietary/policy/input/WebhookInputSource.java

@@ -0,0 +1,145 @@
+package stirling.software.proprietary.policy.input;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Stream;
+
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.util.FileReadinessChecker;
+import stirling.software.proprietary.policy.ledger.FolderIdentities;
+import stirling.software.proprietary.policy.model.InputSpec;
+import stirling.software.proprietary.policy.model.PolicyInputs;
+import stirling.software.proprietary.policy.webhook.WebhookConfig;
+import stirling.software.proprietary.policy.webhook.WebhookIds;
+import stirling.software.proprietary.policy.webhook.WebhookSpool;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class WebhookInputSource implements InputSource {
+
+    static final String TYPE = "webhook";
+
+    private final WebhookSpool spool;
+    private final FileReadinessChecker readinessChecker;
+
+    @Override
+    public String type() {
+        return TYPE;
+    }
+
+    @Override
+    public boolean supports(InputSpec spec) {
+        return spec != null && TYPE.equals(spec.type());
+    }
+
+    @Override
+    public void validate(InputSpec spec) {
+        WebhookConfig.from(spec.options());
+    }
+
+    @Override
+    public Map<String, Object> prepareOptionsForSave(
+            Map<String, Object> options, boolean isCreate) {
+        boolean hasId =
+                options.get(WebhookConfig.WEBHOOK_ID_OPTION) != null
+                        && !options.get(WebhookConfig.WEBHOOK_ID_OPTION).toString().isBlank();
+        if (!isCreate && hasId) {
+            return options;
+        }
+        Map<String, Object> prepared = new LinkedHashMap<>(options);
+        prepared.put(WebhookConfig.WEBHOOK_ID_OPTION, WebhookIds.newWebhookId());
+        prepared.put(WebhookConfig.SIGNING_SECRET_OPTION, WebhookIds.newSigningSecret());
+        return prepared;
+    }
+
+    @Override
+    public List<ResolvedInput> resolve(InputSpec spec, ResolveContext ctx) throws IOException {
+        WebhookConfig config = WebhookConfig.from(spec.options());
+        Path dir = spool.dirFor(config.webhookId());
+        if (!Files.isDirectory(dir)) {
+            ctx.reportPresent(List.of());
+            return List.of();
+        }
+        Path canonicalDir = FolderIdentities.canonicalDir(dir);
+        List<Path> present = listFiles(dir);
+
+        ctx.reportPresent(
+                present.stream()
+                        .map(file -> FolderIdentities.identity(canonicalDir, dir, file))
+                        .toList());
+
+        List<ResolvedInput> work = new ArrayList<>();
+        for (Path file : present) {
+            if (!readinessChecker.isReady(file)) {
+                continue;
+            }
+            String identity = FolderIdentities.identity(canonicalDir, dir, file);
+            String gate;
+            boolean claimed;
+            try {
+                gate = FolderIdentities.statGate(file);
+                claimed = ctx.claim(identity, gate, null);
+            } catch (IOException | UncheckedIOException e) {
+                log.debug("Could not read {} for its version: {}", file, e.getMessage());
+                continue;
+            }
+            if (!claimed) {
+                continue;
+            }
+            work.add(
+                    new ResolvedInput(
+                            PolicyInputs.of(List.of(fileResource(file))),
+                            success -> completeConsumed(ctx, identity, file, gate, success)));
+        }
+        return work;
+    }
+
+    private static void completeConsumed(
+            ResolveContext ctx, String identity, Path file, String claimGate, boolean success) {
+        ctx.settle(identity, claimGate, null, success);
+        if (!success) {
+            return;
+        }
+        try {
+            if (FolderIdentities.statGate(file).equals(claimGate) && ctx.allSettledDone(identity)) {
+                Files.deleteIfExists(file);
+            }
+        } catch (java.nio.file.NoSuchFileException alreadyGone) {
+        } catch (IOException e) {
+            log.warn("Could not remove consumed webhook delivery {}: {}", file, e.getMessage());
+        }
+    }
+
+    private static List<Path> listFiles(Path dir) throws IOException {
+        List<Path> files = new ArrayList<>();
+        try (Stream<Path> entries = Files.list(dir)) {
+            entries.filter(Files::isRegularFile)
+                    .filter(file -> !file.getFileName().toString().startsWith("."))
+                    .forEach(files::add);
+        }
+        return files;
+    }
+
+    private static Resource fileResource(Path path) {
+        String name = WebhookSpool.displayName(path.getFileName().toString());
+        return new FileSystemResource(path.toFile()) {
+            @Override
+            public String getFilename() {
+                return name;
+            }
+        };
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java

@@ -2,6 +2,7 @@ package stirling.software.proprietary.policy.source;
 
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
@@ -44,6 +45,8 @@ import stirling.software.proprietary.util.SecretMasker;
 @Tag(name = "Sources", description = "Reusable policy input connections")
 public class SourceController {
 
+    private static final String WEBHOOK_TYPE = "webhook";
+
     private final SourceStore sourceStore;
     private final SourceAccessGuard sourceAccessGuard;
     private final SourceOverviewService overviewService;
@@ -107,7 +110,8 @@ public class SourceController {
     public ResponseEntity<Source> save(@RequestBody Source source) {
         requireSourceEditingAllowed();
         requireNotEditor(source.id(), source.type());
-        Source owned = withStoredSecrets(resolveOwnership(source));
+        boolean isCreate = source.id() == null || source.id().isBlank();
+        Source owned = withPreparedOptions(withStoredSecrets(resolveOwnership(source)), isCreate);
         try {
             validateConfig(owned);
         } catch (IllegalArgumentException e) {
@@ -117,7 +121,7 @@ public class SourceController {
         // An edited folder source can change which directory needs watching, so re-sync trigger
         // registrations now instead of waiting for the next reconcile.
         policyTriggerManager.notifyPoliciesChanged();
-        return ResponseEntity.ok(withMaskedSecrets(saved));
+        return ResponseEntity.ok(revealOnCreate(saved, isCreate));
     }
 
     @DeleteMapping("/{sourceId}")
@@ -219,14 +223,33 @@ public class SourceController {
     /** Validate the config against the bean that handles the source's type, as the engine will. */
     private void validateConfig(Source source) {
         InputSpec spec = source.toInputSpec();
-        inputSources.stream()
-                .filter(inputSource -> inputSource.supports(spec))
-                .findFirst()
+        inputSourceFor(spec)
                 .orElseThrow(
                         () -> new IllegalArgumentException("unknown source type: " + source.type()))
                 .validate(spec);
     }
 
+    private Source withPreparedOptions(Source source, boolean isCreate) {
+        InputSpec spec = source.toInputSpec();
+        InputSource input = inputSourceFor(spec).orElse(null);
+        if (input == null) {
+            return source;
+        }
+        Map<String, Object> prepared = input.prepareOptionsForSave(source.options(), isCreate);
+        return prepared == null ? source : withOptions(source, prepared);
+    }
+
+    private static Source revealOnCreate(Source saved, boolean isCreate) {
+        if (isCreate && WEBHOOK_TYPE.equals(saved.type())) {
+            return saved;
+        }
+        return withMaskedSecrets(saved);
+    }
+
+    private Optional<InputSource> inputSourceFor(InputSpec spec) {
+        return inputSources.stream().filter(input -> input.supports(spec)).findFirst();
+    }
+
     /**
      * Editing sources requires the editor role for the caller's team (a team leader on SaaS), the
      * same rule as policies. Single-user deployments (login disabled) trust the local operator.

app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java

@@ -100,7 +100,8 @@ public class SourceOverviewService {
                 List.of(),
                 docs.total(),
                 docs.last24h(),
-                docs.last30d());
+                docs.last30d(),
+                null);
     }
 
     /**
@@ -141,7 +142,16 @@ public class SourceOverviewService {
                 configRows(source),
                 docs.total(),
                 docs.last24h(),
-                docs.last30d());
+                docs.last30d(),
+                webhookPath(source));
+    }
+
+    private static String webhookPath(Source source) {
+        if (!"webhook".equals(source.type())) {
+            return null;
+        }
+        Object webhookId = source.options().get("webhookId");
+        return webhookId == null ? null : "/api/v1/webhooks/" + webhookId;
     }
 
     /** A disabled (paused) source reads as "disabled"; an unreferenced one reads as "unused". */

app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceView.java

@@ -17,7 +17,8 @@ public record SourceView(
         List<DetailRow> config,
         long docsTotal,
         long docs24h,
-        long docs30d) {
+        long docs30d,
+        String webhookPath) {
 
     /** A policy that references this source. */
     public record PolicyRef(String id, String name) {}

app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/WebhookTrigger.java

@@ -0,0 +1,130 @@
+package stirling.software.proprietary.policy.trigger;
+
+import java.util.Set;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.policy.engine.PolicyRunner;
+import stirling.software.proprietary.policy.engine.SweepKind;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.store.PolicyStore;
+import stirling.software.proprietary.policy.webhook.WebhookConfig;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class WebhookTrigger implements PolicyTrigger {
+
+    static final String TYPE = "webhook";
+    private static final String WEBHOOK_SOURCE_TYPE = "webhook";
+
+    private final PolicyStore policyStore;
+    private final PolicyRunner policyRunner;
+    private final SourceStore sourceStore;
+    private final ApplicationProperties applicationProperties;
+
+    private volatile ScheduledExecutorService reconciler;
+
+    @Override
+    public String type() {
+        return TYPE;
+    }
+
+    @Override
+    public boolean requiresSource() {
+        return true;
+    }
+
+    @Override
+    public Set<String> supportedSourceTypes() {
+        return Set.of(WEBHOOK_SOURCE_TYPE);
+    }
+
+    @Override
+    public void validate(Policy policy) {
+        boolean hasWebhookSource =
+                policy.sourceIds().stream()
+                        .map(sourceStore::get)
+                        .flatMap(java.util.Optional::stream)
+                        .anyMatch(source -> WEBHOOK_SOURCE_TYPE.equals(source.type()));
+        if (!hasWebhookSource) {
+            throw new IllegalArgumentException(
+                    "webhook trigger requires at least one webhook input source");
+        }
+    }
+
+    @Override
+    public synchronized void start() {
+        if (reconciler != null) {
+            return;
+        }
+        long reconcileSeconds = applicationProperties.getPolicies().getWatchReconcileSeconds();
+        reconciler =
+                Executors.newSingleThreadScheduledExecutor(
+                        Thread.ofVirtual().name("policy-webhook-reconcile-", 0).factory());
+        reconciler.scheduleAtFixedRate(this::safeReconcile, 0, reconcileSeconds, TimeUnit.SECONDS);
+        log.info("Webhook trigger started (reconcile every {}s)", reconcileSeconds);
+    }
+
+    @Override
+    public synchronized void stop() {
+        if (reconciler != null) {
+            reconciler.shutdownNow();
+            reconciler = null;
+        }
+    }
+
+    public void fireForWebhook(String webhookId) {
+        for (Policy policy : policyStore.findByTriggerType(TYPE)) {
+            if (!referencesWebhook(policy, webhookId)) {
+                continue;
+            }
+            try {
+                log.debug("Webhook policy {} ({}) saw a delivery", policy.id(), policy.name());
+                policyRunner.run(policy, SweepKind.LIGHT);
+            } catch (RuntimeException e) {
+                log.warn("Webhook run failed for policy {}: {}", policy.id(), e.getMessage());
+            }
+        }
+    }
+
+    private void safeReconcile() {
+        try {
+            for (Policy policy : policyStore.findByTriggerType(TYPE)) {
+                try {
+                    policyRunner.run(policy);
+                } catch (RuntimeException e) {
+                    log.warn(
+                            "Webhook reconcile run failed for policy {}: {}",
+                            policy.id(),
+                            e.getMessage());
+                }
+            }
+        } catch (RuntimeException e) {
+            log.error("Webhook reconcile failed: {}", e.getMessage(), e);
+        }
+    }
+
+    private boolean referencesWebhook(Policy policy, String webhookId) {
+        for (String sourceId : policy.sourceIds()) {
+            Source source = sourceStore.get(sourceId).orElse(null);
+            if (source == null || !WEBHOOK_SOURCE_TYPE.equals(source.type())) {
+                continue;
+            }
+            Object configured = source.options().get(WebhookConfig.WEBHOOK_ID_OPTION);
+            if (configured != null && configured.toString().equals(webhookId)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookConfig.java

@@ -0,0 +1,37 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.util.Map;
+
+public record WebhookConfig(String webhookId, String signingSecret) {
+
+    public static final String WEBHOOK_ID_OPTION = "webhookId";
+    public static final String SIGNING_SECRET_OPTION = "signingSecret";
+
+    public static WebhookConfig from(Map<String, Object> options) {
+        String webhookId = trimmed(options.get(WEBHOOK_ID_OPTION));
+        if (webhookId == null) {
+            throw new IllegalArgumentException("webhook config requires a 'webhookId' option");
+        }
+        if (!WebhookIds.isValidId(webhookId)) {
+            throw new IllegalArgumentException("webhook config 'webhookId' has an invalid format");
+        }
+        String signingSecret = trimmed(options.get(SIGNING_SECRET_OPTION));
+        if (signingSecret == null) {
+            throw new IllegalArgumentException("webhook config requires a 'signingSecret' option");
+        }
+        return new WebhookConfig(webhookId, signingSecret);
+    }
+
+    private static String trimmed(Object value) {
+        if (value == null) {
+            return null;
+        }
+        String text = value.toString().trim();
+        return text.isEmpty() ? null : text;
+    }
+
+    @Override
+    public String toString() {
+        return "WebhookConfig[webhookId=" + webhookId + "]";
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookIds.java

@@ -0,0 +1,33 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.security.SecureRandom;
+import java.util.Base64;
+import java.util.regex.Pattern;
+
+public final class WebhookIds {
+
+    private static final Pattern VALID_ID = Pattern.compile("^[A-Za-z0-9_-]{16,128}$");
+
+    private static final SecureRandom RANDOM = new SecureRandom();
+    private static final Base64.Encoder ENCODER = Base64.getUrlEncoder().withoutPadding();
+
+    private WebhookIds() {}
+
+    public static String newWebhookId() {
+        return randomToken(18);
+    }
+
+    public static String newSigningSecret() {
+        return randomToken(32);
+    }
+
+    public static boolean isValidId(String id) {
+        return id != null && VALID_ID.matcher(id).matches();
+    }
+
+    private static String randomToken(int bytes) {
+        byte[] buffer = new byte[bytes];
+        RANDOM.nextBytes(buffer);
+        return ENCODER.encodeToString(buffer);
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookReceiverController.java

@@ -0,0 +1,150 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Arrays;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+
+import io.swagger.v3.oas.annotations.Hidden;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.trigger.WebhookTrigger;
+
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/webhooks")
+@Hidden
+@RequiredArgsConstructor
+@Tag(name = "Webhooks", description = "Inbound webhook source receiver")
+public class WebhookReceiverController {
+
+    static final String SIGNATURE_HEADER = "X-Stirling-Signature";
+    static final String FILENAME_HEADER = "X-Stirling-Filename";
+    private static final String WEBHOOK_TYPE = "webhook";
+
+    private final SourceStore sourceStore;
+    private final WebhookSpool spool;
+    private final WebhookTrigger webhookTrigger;
+    private final ApplicationProperties applicationProperties;
+
+    @PostMapping("/{webhookId}")
+    @Operation(
+            summary = "Deliver a document to a webhook source",
+            description =
+                    "The body is the raw document; sign it with the source's secret and present"
+                            + " 'sha256=<hex>' in the X-Stirling-Signature header. Returns 202 once"
+                            + " the document is spooled for the referencing policies.")
+    public ResponseEntity<WebhookDeliveryResponse> receive(
+            @PathVariable String webhookId,
+            @RequestHeader(value = SIGNATURE_HEADER, required = false) String signature,
+            @RequestHeader(value = FILENAME_HEADER, required = false) String filename,
+            HttpServletRequest request) {
+        if (!WebhookIds.isValidId(webhookId)) {
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "No such webhook");
+        }
+        Source source = findWebhookSource(webhookId);
+        if (source == null) {
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "No such webhook");
+        }
+
+        WebhookConfig config = WebhookConfig.from(source.options());
+        byte[] body = readBoundedBody(request);
+        if (!WebhookSignatures.verify(config.signingSecret(), body, signature)) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Invalid signature");
+        }
+        if (!source.enabled()) {
+            throw new ResponseStatusException(
+                    HttpStatus.FORBIDDEN, "Webhook source is paused; deliveries are not accepted");
+        }
+        if (body.length == 0) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Empty request body");
+        }
+
+        String storedName = stageToSpool(webhookId, filename, body);
+
+        webhookTrigger.fireForWebhook(webhookId);
+        log.info(
+                "Accepted webhook delivery '{}' ({} bytes) for {}",
+                storedName,
+                body.length,
+                webhookId);
+        return ResponseEntity.accepted()
+                .contentType(MediaType.APPLICATION_JSON)
+                .body(new WebhookDeliveryResponse(true, storedName, body.length));
+    }
+
+    private Source findWebhookSource(String webhookId) {
+        for (Source source : sourceStore.all()) {
+            if (!WEBHOOK_TYPE.equals(source.type())) {
+                continue;
+            }
+            Object configured = source.options().get(WebhookConfig.WEBHOOK_ID_OPTION);
+            if (configured != null && configured.toString().equals(webhookId)) {
+                return source;
+            }
+        }
+        return null;
+    }
+
+    private String stageToSpool(String webhookId, String filename, byte[] body) {
+        try {
+            return WebhookSpool.displayName(
+                    spool.store(webhookId, filename, body).getFileName().toString());
+        } catch (IOException e) {
+            log.error("Could not spool webhook delivery for {}: {}", webhookId, e.getMessage());
+            throw new ResponseStatusException(
+                    HttpStatus.INTERNAL_SERVER_ERROR, "Could not store delivery");
+        }
+    }
+
+    private byte[] readBoundedBody(HttpServletRequest request) {
+        long maxBytes = applicationProperties.getPolicies().getWebhookMaxBytes();
+        long declared = request.getContentLengthLong();
+        if (declared < 0) {
+            throw new ResponseStatusException(
+                    HttpStatus.LENGTH_REQUIRED, "A Content-Length header is required");
+        }
+        if (declared > maxBytes) {
+            throw new ResponseStatusException(
+                    HttpStatus.PAYLOAD_TOO_LARGE,
+                    "Delivery exceeds the " + maxBytes + "-byte limit");
+        }
+        byte[] body = new byte[(int) declared];
+        int total = 0;
+        try (InputStream in = request.getInputStream()) {
+            int read;
+            while (total < body.length
+                    && (read = in.read(body, total, body.length - total)) != -1) {
+                total += read;
+            }
+            if (total == body.length && in.read() != -1) {
+                throw new ResponseStatusException(
+                        HttpStatus.BAD_REQUEST, "Body exceeds the declared Content-Length");
+            }
+        } catch (IOException e) {
+            throw new ResponseStatusException(
+                    HttpStatus.BAD_REQUEST, "Could not read request body");
+        }
+        return total == body.length ? body : Arrays.copyOf(body, total);
+    }
+
+    public record WebhookDeliveryResponse(boolean accepted, String filename, int bytes) {}
+}

app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSignatures.java

@@ -0,0 +1,49 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.HexFormat;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+
+public final class WebhookSignatures {
+
+    private static final String ALGORITHM = "HmacSHA256";
+    private static final String PREFIX = "sha256=";
+
+    private WebhookSignatures() {}
+
+    public static String sign(String signingSecret, byte[] body) {
+        return PREFIX + HexFormat.of().formatHex(hmac(signingSecret, body));
+    }
+
+    public static boolean verify(String signingSecret, byte[] body, String presented) {
+        if (signingSecret == null || presented == null || body == null) {
+            return false;
+        }
+        String hex = presented.trim();
+        if (hex.regionMatches(true, 0, PREFIX, 0, PREFIX.length())) {
+            hex = hex.substring(PREFIX.length());
+        }
+        byte[] presentedBytes;
+        try {
+            presentedBytes = HexFormat.of().parseHex(hex);
+        } catch (IllegalArgumentException notHex) {
+            return false;
+        }
+        return MessageDigest.isEqual(hmac(signingSecret, body), presentedBytes);
+    }
+
+    private static byte[] hmac(String signingSecret, byte[] body) {
+        try {
+            Mac mac = Mac.getInstance(ALGORITHM);
+            mac.init(new SecretKeySpec(signingSecret.getBytes(StandardCharsets.UTF_8), ALGORITHM));
+            return mac.doFinal(body);
+        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
+            throw new IllegalStateException("HMAC-SHA256 unavailable", e);
+        }
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSpool.java

@@ -0,0 +1,87 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.util.UUID;
+
+import org.springframework.stereotype.Component;
+
+import stirling.software.common.configuration.InstallationPathConfig;
+
+@Component
+public class WebhookSpool {
+
+    private static final String SPOOL_DIR = "policy-webhook-spool";
+    private static final String TEMP_SUFFIX = ".part";
+    private static final String DEFAULT_NAME = "document.pdf";
+    private static final int UNIQUE_LEN = 32;
+
+    private final Path spoolRoot;
+
+    public WebhookSpool() {
+        this(Path.of(InstallationPathConfig.getPath(), SPOOL_DIR));
+    }
+
+    public WebhookSpool(Path spoolRoot) {
+        this.spoolRoot = spoolRoot.toAbsolutePath().normalize();
+    }
+
+    public Path dirFor(String webhookId) {
+        if (!WebhookIds.isValidId(webhookId)) {
+            throw new IllegalArgumentException("invalid webhookId");
+        }
+        Path dir = spoolRoot.resolve(webhookId).normalize();
+        if (!dir.getParent().equals(spoolRoot)) {
+            throw new IllegalArgumentException("invalid webhookId");
+        }
+        return dir;
+    }
+
+    public Path store(String webhookId, String filename, byte[] content) throws IOException {
+        Path dir = dirFor(webhookId);
+        Files.createDirectories(dir);
+        String finalName = spoolName(filename);
+        Path target = dir.resolve(finalName).normalize();
+        Path temp = dir.resolve("." + finalName + TEMP_SUFFIX).normalize();
+        if (!target.startsWith(dir) || !temp.startsWith(dir)) {
+            throw new IllegalArgumentException("invalid delivery name");
+        }
+        Files.write(temp, content);
+        try {
+            Files.move(temp, target, StandardCopyOption.ATOMIC_MOVE);
+        } catch (IOException atomicUnsupported) {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING);
+        }
+        return target;
+    }
+
+    static String spoolName(String filename) {
+        return UUID.randomUUID().toString().replace("-", "") + "-" + sanitize(filename);
+    }
+
+    public static String displayName(String spoolFileName) {
+        int dash = spoolFileName.indexOf('-');
+        if (dash == UNIQUE_LEN && dash + 1 < spoolFileName.length()) {
+            return spoolFileName.substring(dash + 1);
+        }
+        return spoolFileName;
+    }
+
+    private static String sanitize(String filename) {
+        if (filename == null) {
+            return DEFAULT_NAME;
+        }
+        String base = filename.replace('\\', '/');
+        int slash = base.lastIndexOf('/');
+        if (slash >= 0) {
+            base = base.substring(slash + 1);
+        }
+        base = base.replaceAll("[^A-Za-z0-9._-]", "_").trim();
+        while (base.startsWith(".")) {
+            base = base.substring(1);
+        }
+        return base.isEmpty() ? DEFAULT_NAME : base;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/util/SecretMasker.java

@@ -22,7 +22,7 @@ public final class SecretMasker {
                     .getPattern(
                             // secret[_-]?access[_-]?key precedes plain secret so camelCase keys
                             // like secretAccessKey (no word boundary after "secret") still match.
-                            "(?i)\\b(password|token|secret[_-]?access[_-]?key|secret|api[_-]?key|authorization|auth|jwt|cred|cert)\\b");
+                            "(?i)\\b(password|token|secret[_-]?access[_-]?key|signing[_-]?secret|secret|api[_-]?key|authorization|auth|jwt|cred|cert)\\b");
 
     private SecretMasker() {}
 

app/proprietary/src/test/java/stirling/software/proprietary/policy/input/WebhookInputSourceTest.java

@@ -0,0 +1,165 @@
+package stirling.software.proprietary.policy.input;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.lenient;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Supplier;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import stirling.software.common.util.FileReadinessChecker;
+import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
+import stirling.software.proprietary.policy.model.InputSpec;
+import stirling.software.proprietary.policy.webhook.WebhookConfig;
+import stirling.software.proprietary.policy.webhook.WebhookSpool;
+
+@ExtendWith(MockitoExtension.class)
+class WebhookInputSourceTest {
+
+    private static final String POLICY = "p1";
+    private static final String WEBHOOK_ID = "testwebhookid1234";
+
+    @Mock private FileReadinessChecker readinessChecker;
+
+    @TempDir Path tempDir;
+
+    private WebhookSpool spool;
+    private WebhookInputSource source;
+    private InProcessProcessedLedger ledger;
+    private RecordingContext ctx;
+
+    @BeforeEach
+    void setUp() {
+        spool = new WebhookSpool(tempDir.resolve("spool"));
+        source = new WebhookInputSource(spool, readinessChecker);
+        ledger = new InProcessProcessedLedger();
+        ctx = new RecordingContext();
+        lenient().when(readinessChecker.isReady(any())).thenReturn(true);
+    }
+
+    private static InputSpec spec(String mode) {
+        return new InputSpec(
+                "webhook",
+                Map.of("webhookId", WEBHOOK_ID, "signingSecret", "secret", "mode", mode));
+    }
+
+    @Test
+    void consumeRemovesTheDeliveryOnceProcessed() throws IOException {
+        Path delivered = spool.store(WEBHOOK_ID, "doc.pdf", "data".getBytes());
+
+        List<ResolvedInput> work = source.resolve(spec("consume"), ctx);
+
+        assertEquals(1, work.size());
+        assertEquals("doc.pdf", work.get(0).inputs().primary().get(0).getFilename());
+        assertTrue(Files.exists(delivered));
+        assertTrue(source.resolve(spec("consume"), ctx).isEmpty());
+
+        work.get(0).onComplete().accept(true);
+        assertTrue(Files.notExists(delivered));
+        assertTrue(source.resolve(spec("consume"), ctx).isEmpty());
+    }
+
+    @Test
+    void aFailedRunLeavesTheDeliveryInPlace() throws IOException {
+        Path delivered = spool.store(WEBHOOK_ID, "doc.pdf", "data".getBytes());
+
+        List<ResolvedInput> work = source.resolve(spec("consume"), ctx);
+        work.get(0).onComplete().accept(false);
+
+        assertTrue(Files.exists(delivered));
+    }
+
+    @Test
+    void nothingDeliveredIsAnEmptySourceNotAnError() throws IOException {
+        List<ResolvedInput> work = source.resolve(spec("consume"), ctx);
+        assertTrue(work.isEmpty());
+        assertTrue(ctx.present.isEmpty());
+    }
+
+    @Test
+    void validateRejectsMissingIdOrSecret() {
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> source.validate(new InputSpec("webhook", Map.of("signingSecret", "s"))));
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> source.validate(new InputSpec("webhook", Map.of("webhookId", WEBHOOK_ID))));
+    }
+
+    @Test
+    void prepareMintsIdAndSecretOnCreate() {
+        Map<String, Object> prepared =
+                source.prepareOptionsForSave(Map.of("mode", "consume"), true);
+
+        String id = prepared.get(WebhookConfig.WEBHOOK_ID_OPTION).toString();
+        String secret = prepared.get(WebhookConfig.SIGNING_SECRET_OPTION).toString();
+        assertFalse(id.isBlank());
+        assertFalse(secret.isBlank());
+        assertEquals("consume", prepared.get("mode"));
+        Map<String, Object> other = source.prepareOptionsForSave(Map.of(), true);
+        assertNotEquals(id, other.get(WebhookConfig.WEBHOOK_ID_OPTION).toString());
+    }
+
+    @Test
+    void prepareLeavesAnExistingWebhookUntouchedOnEdit() {
+        Map<String, Object> existing = Map.of("webhookId", WEBHOOK_ID, "signingSecret", "keepme");
+
+        Map<String, Object> prepared = source.prepareOptionsForSave(existing, false);
+
+        assertEquals(WEBHOOK_ID, prepared.get("webhookId"));
+        assertEquals("keepme", prepared.get("signingSecret"));
+    }
+
+    @Test
+    void prepareIgnoresClientSuppliedIdAndSecretOnCreate() {
+        Map<String, Object> prepared =
+                source.prepareOptionsForSave(
+                        Map.of("webhookId", "client-chosen-id", "signingSecret", "weak"), true);
+
+        assertNotEquals("client-chosen-id", prepared.get(WebhookConfig.WEBHOOK_ID_OPTION));
+        assertNotEquals("weak", prepared.get(WebhookConfig.SIGNING_SECRET_OPTION));
+    }
+
+    private class RecordingContext implements ResolveContext {
+
+        private final List<String> present = new ArrayList<>();
+
+        @Override
+        public boolean claim(String identity, String gate, Supplier<String> contentHash) {
+            return ledger.claim(POLICY, identity, gate, contentHash);
+        }
+
+        @Override
+        public void settle(
+                String identity, String finalGate, String finalContentHash, boolean success) {
+            ledger.settle(POLICY, identity, finalGate, finalContentHash, success);
+        }
+
+        @Override
+        public boolean allSettledDone(String identity) {
+            return ledger.allSettledDone(identity);
+        }
+
+        @Override
+        public void reportPresent(Collection<String> identities) {
+            present.addAll(identities);
+        }
+    }
+}

app/proprietary/src/test/java/stirling/software/proprietary/policy/source/SourceControllerTest.java

@@ -1,33 +1,41 @@
 package stirling.software.proprietary.policy.source;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
+import java.nio.file.Path;
 import java.util.List;
 import java.util.Map;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.server.ResponseStatusException;
 
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.service.UserServiceInterface;
+import stirling.software.common.util.FileReadinessChecker;
 import stirling.software.proprietary.policy.config.PolicyAccessGuard;
 import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
 import stirling.software.proprietary.policy.input.InputSource;
+import stirling.software.proprietary.policy.input.WebhookInputSource;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.model.PipelineStep;
 import stirling.software.proprietary.policy.model.Policy;
 import stirling.software.proprietary.policy.store.InProcessPolicyStore;
 import stirling.software.proprietary.policy.store.PolicyStore;
 import stirling.software.proprietary.policy.trigger.PolicyTriggerManager;
+import stirling.software.proprietary.policy.webhook.WebhookSpool;
 import stirling.software.proprietary.util.SecretMasker;
 
 /**
@@ -41,6 +49,9 @@ class SourceControllerTest {
     private final PolicyStore policyStore = new InProcessPolicyStore();
     private PolicyTriggerManager triggerManager;
     private SourceController controller;
+    private SourceController webhookController;
+
+    @TempDir Path tempDir;
 
     @BeforeEach
     void setUp() {
@@ -61,6 +72,8 @@ class SourceControllerTest {
         // A permissive input source so config validation passes and save can be exercised.
         InputSource folderInput = mock(InputSource.class);
         when(folderInput.supports(any())).thenReturn(true);
+        when(folderInput.prepareOptionsForSave(any(), anyBoolean()))
+                .thenAnswer(invocation -> invocation.getArgument(0));
         controller =
                 new SourceController(
                         sourceStore,
@@ -72,6 +85,45 @@ class SourceControllerTest {
                         triggerManager,
                         properties,
                         List.of(folderInput));
+        WebhookInputSource webhookInput =
+                new WebhookInputSource(new WebhookSpool(tempDir), mock(FileReadinessChecker.class));
+        webhookController =
+                new SourceController(
+                        sourceStore,
+                        sourceGuard,
+                        overviewService,
+                        policyStore,
+                        policyGuard,
+                        authority,
+                        triggerManager,
+                        properties,
+                        List.of(webhookInput));
+    }
+
+    @Test
+    void creatingAWebhookRevealsItsSecretOnceThenMasks() {
+        Source created =
+                webhookController
+                        .save(
+                                new Source(
+                                        null,
+                                        "Partner uploads",
+                                        "webhook",
+                                        Map.of("mode", "consume"),
+                                        true,
+                                        null,
+                                        null))
+                        .getBody();
+
+        String secret = String.valueOf(created.options().get("signingSecret"));
+        String webhookId = String.valueOf(created.options().get("webhookId"));
+        assertNotEquals(SecretMasker.REDACTED, secret);
+        assertFalse(secret.isBlank());
+        assertFalse(webhookId.isBlank());
+
+        Source read = webhookController.get(created.id()).getBody();
+        assertEquals(SecretMasker.REDACTED, read.options().get("signingSecret"));
+        assertEquals(webhookId, read.options().get("webhookId"));
     }
 
     @Test

app/proprietary/src/test/java/stirling/software/proprietary/policy/trigger/WebhookTriggerTest.java

@@ -0,0 +1,115 @@
+package stirling.software.proprietary.policy.trigger;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.policy.engine.PolicyRunner;
+import stirling.software.proprietary.policy.engine.SweepKind;
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.PipelineStep;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.model.TriggerConfig;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.store.PolicyStore;
+
+@ExtendWith(MockitoExtension.class)
+class WebhookTriggerTest {
+
+    private static final String TYPE = "webhook";
+
+    @Mock private PolicyStore policyStore;
+    @Mock private PolicyRunner policyRunner;
+
+    private final SourceStore sourceStore = new InProcessSourceStore();
+    private WebhookTrigger trigger;
+
+    @BeforeEach
+    void setUp() {
+        trigger =
+                new WebhookTrigger(
+                        policyStore, policyRunner, sourceStore, new ApplicationProperties());
+    }
+
+    @Test
+    void firesOnlyPoliciesReferencingTheDeliveredWebhook() {
+        Policy matching = webhookPolicy("a", "whkA");
+        Policy other = webhookPolicy("b", "whkB");
+        when(policyStore.findByTriggerType(TYPE)).thenReturn(List.of(matching, other));
+
+        trigger.fireForWebhook("whkA");
+
+        verify(policyRunner).run(matching, SweepKind.LIGHT);
+        verify(policyRunner, never()).run(other, SweepKind.LIGHT);
+    }
+
+    @Test
+    void ignoresADeliveryForAnUnknownWebhookId() {
+        Policy policy = webhookPolicy("a", "whkA");
+        when(policyStore.findByTriggerType(TYPE)).thenReturn(List.of(policy));
+
+        trigger.fireForWebhook("whkZ");
+
+        verify(policyRunner, never()).run(any(), any(SweepKind.class));
+    }
+
+    @Test
+    void validateRequiresAWebhookSource() {
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> trigger.validate(policy("p", webhookTriggerConfig(), List.of())));
+        trigger.validate(webhookPolicy("p", "whkA"));
+    }
+
+    private static TriggerConfig webhookTriggerConfig() {
+        return new TriggerConfig(TYPE, Map.of());
+    }
+
+    private Policy webhookPolicy(String id, String webhookId) {
+        String sourceId =
+                sourceStore
+                        .save(
+                                new Source(
+                                        null,
+                                        "hook",
+                                        "webhook",
+                                        Map.of(
+                                                "webhookId",
+                                                webhookId,
+                                                "signingSecret",
+                                                "s",
+                                                "mode",
+                                                "consume"),
+                                        true,
+                                        "owner",
+                                        null))
+                        .id();
+        return policy(id, webhookTriggerConfig(), List.of(sourceId));
+    }
+
+    private static Policy policy(String id, TriggerConfig trigger, List<String> sourceIds) {
+        return new Policy(
+                id,
+                "hook",
+                "owner",
+                true,
+                trigger,
+                sourceIds,
+                List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                OutputSpec.inline());
+    }
+}

app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookLocalDeliveryE2eTest.java

@@ -0,0 +1,137 @@
+package stirling.software.proprietary.policy.webhook;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Supplier;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.springframework.mock.web.MockHttpServletRequest;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.util.FileReadinessChecker;
+import stirling.software.proprietary.policy.input.ResolveContext;
+import stirling.software.proprietary.policy.input.ResolvedInput;
+import stirling.software.proprietary.policy.input.WebhookInputSource;
+import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
+import stirling.software.proprietary.policy.model.InputSpec;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.trigger.WebhookTrigger;
+
+class WebhookLocalDeliveryE2eTest {
+
+    private static final String POLICY = "p1";
+    private static final String WEBHOOK_ID = "localwebhookid12";
+    private static final String SECRET = "topsecret";
+
+    @TempDir Path tempDir;
+
+    private WebhookReceiverController receiver;
+    private WebhookInputSource inputSource;
+    private WebhookTrigger trigger;
+    private InProcessProcessedLedger ledger;
+    private RecordingContext ctx;
+
+    @BeforeEach
+    void setUp() {
+        WebhookSpool spool = new WebhookSpool(tempDir.resolve("spool"));
+        SourceStore sourceStore = new InProcessSourceStore();
+        sourceStore.save(
+                new Source(
+                        "s1",
+                        "Partner uploads",
+                        "webhook",
+                        Map.of("webhookId", WEBHOOK_ID, "signingSecret", SECRET, "mode", "consume"),
+                        true,
+                        "owner",
+                        null));
+        trigger = mock(WebhookTrigger.class);
+        FileReadinessChecker readiness = mock(FileReadinessChecker.class);
+        when(readiness.isReady(any())).thenReturn(true);
+        receiver =
+                new WebhookReceiverController(
+                        sourceStore, spool, trigger, new ApplicationProperties());
+        inputSource = new WebhookInputSource(spool, readiness);
+        ledger = new InProcessProcessedLedger();
+        ctx = new RecordingContext();
+    }
+
+    @Test
+    void aDeliveryIsSpooledFiresTheTriggerThenIsReadAndConsumed() throws IOException {
+        byte[] body = "a pdf".getBytes(StandardCharsets.UTF_8);
+        String signature = WebhookSignatures.sign(SECRET, body);
+
+        var response = receiver.receive(WEBHOOK_ID, signature, "invoice.pdf", request(body));
+        assertThat(response.getStatusCode().value()).isEqualTo(202);
+        verify(trigger).fireForWebhook(WEBHOOK_ID);
+
+        List<ResolvedInput> work = inputSource.resolve(spec(), ctx);
+        assertThat(work).hasSize(1);
+        assertThat(work.get(0).inputs().primary().get(0).getFilename()).isEqualTo("invoice.pdf");
+        assertThat(read(work.get(0))).isEqualTo("a pdf");
+        assertThat(inputSource.resolve(spec(), ctx)).isEmpty();
+
+        work.get(0).onComplete().accept(true);
+        assertThat(inputSource.resolve(spec(), ctx)).isEmpty();
+    }
+
+    private static InputSpec spec() {
+        return new InputSpec(
+                "webhook",
+                Map.of("webhookId", WEBHOOK_ID, "signingSecret", SECRET, "mode", "consume"));
+    }
+
+    private static MockHttpServletRequest request(byte[] body) {
+        MockHttpServletRequest req =
+                new MockHttpServletRequest("POST", "/api/v1/webhooks/" + WEBHOOK_ID);
+        req.setContent(body);
+        return req;
+    }
+
+    private static String read(ResolvedInput unit) throws IOException {
+        try (InputStream stream = unit.inputs().primary().get(0).getInputStream()) {
+            return new String(stream.readAllBytes(), StandardCharsets.UTF_8);
+        }
+    }
+
+    private class RecordingContext implements ResolveContext {
+
+        private final List<String> present = new ArrayList<>();
+
+        @Override
+        public boolean claim(String identity, String gate, Supplier<String> contentHash) {
+            return ledger.claim(POLICY, identity, gate, contentHash);
+        }
+
+        @Override
+        public void settle(
+                String identity, String finalGate, String finalContentHash, boolean success) {
+            ledger.settle(POLICY, identity, finalGate, finalContentHash, success);
+        }
+
+        @Override
+        public boolean allSettledDone(String identity) {
+            return ledger.allSettledDone(identity);
+        }
+
+        @Override
+        public void reportPresent(Collection<String> identities) {
+            present.addAll(identities);
+        }
+    }
+}

app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookReceiverControllerTest.java

@@ -0,0 +1,193 @@
+package stirling.software.proprietary.policy.webhook;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Stream;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.springframework.http.ResponseEntity;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.web.server.ResponseStatusException;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.trigger.WebhookTrigger;
+import stirling.software.proprietary.policy.webhook.WebhookReceiverController.WebhookDeliveryResponse;
+
+class WebhookReceiverControllerTest {
+
+    private static final String WEBHOOK_ID = "receivertestid12";
+    private static final String SECRET = "topsecret";
+    private static final byte[] BODY = "a pdf".getBytes(StandardCharsets.UTF_8);
+
+    @TempDir Path tempDir;
+
+    private SourceStore sourceStore;
+    private WebhookSpool spool;
+    private WebhookTrigger trigger;
+    private ApplicationProperties properties;
+    private WebhookReceiverController controller;
+
+    @BeforeEach
+    void setUp() {
+        sourceStore = new InProcessSourceStore();
+        sourceStore.save(webhookSource(true));
+        spool = new WebhookSpool(tempDir.resolve("spool"));
+        trigger = mock(WebhookTrigger.class);
+        properties = new ApplicationProperties();
+        controller = new WebhookReceiverController(sourceStore, spool, trigger, properties);
+    }
+
+    private static Source webhookSource(boolean enabled) {
+        return new Source(
+                "s1",
+                "Partner uploads",
+                "webhook",
+                Map.of("webhookId", WEBHOOK_ID, "signingSecret", SECRET, "mode", "consume"),
+                enabled,
+                "owner",
+                null);
+    }
+
+    private static MockHttpServletRequest request(byte[] body) {
+        MockHttpServletRequest req =
+                new MockHttpServletRequest("POST", "/api/v1/webhooks/" + WEBHOOK_ID);
+        req.setContent(body);
+        return req;
+    }
+
+    @Test
+    void aValidDeliveryIsSpooledAndFiresTheTrigger() throws IOException {
+        String signature = WebhookSignatures.sign(SECRET, BODY);
+
+        ResponseEntity<WebhookDeliveryResponse> response =
+                controller.receive(WEBHOOK_ID, signature, "invoice.pdf", request(BODY));
+
+        assertEquals(202, response.getStatusCode().value());
+        assertTrue(response.getBody().accepted());
+        assertEquals("invoice.pdf", response.getBody().filename());
+        assertEquals(1, spooledFiles().size());
+        verify(trigger).fireForWebhook(WEBHOOK_ID);
+    }
+
+    @Test
+    void aWrongSignatureIsRejectedAndStoresNothing() {
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () ->
+                                controller.receive(
+                                        WEBHOOK_ID, "sha256=deadbeef", "x.pdf", request(BODY)));
+
+        assertEquals(401, ex.getStatusCode().value());
+        assertTrue(spooledFiles().isEmpty());
+        verify(trigger, never()).fireForWebhook(WEBHOOK_ID);
+    }
+
+    @Test
+    void anUnknownWebhookIsNotFound() {
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () ->
+                                controller.receive(
+                                        "unknownwebhookid",
+                                        WebhookSignatures.sign(SECRET, BODY),
+                                        "x.pdf",
+                                        request(BODY)));
+
+        assertEquals(404, ex.getStatusCode().value());
+    }
+
+    @Test
+    void aPausedSourceRejectsDeliveries() {
+        sourceStore.save(webhookSource(false));
+        String signature = WebhookSignatures.sign(SECRET, BODY);
+
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () -> controller.receive(WEBHOOK_ID, signature, "x.pdf", request(BODY)));
+
+        assertEquals(403, ex.getStatusCode().value());
+        assertTrue(spooledFiles().isEmpty());
+    }
+
+    @Test
+    void anEmptyBodyIsRejected() {
+        byte[] empty = new byte[0];
+        String signature = WebhookSignatures.sign(SECRET, empty);
+
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () -> controller.receive(WEBHOOK_ID, signature, null, request(empty)));
+
+        assertEquals(400, ex.getStatusCode().value());
+    }
+
+    @Test
+    void anOversizeDeliveryIsRejectedBeforeStoring() {
+        properties.getPolicies().setWebhookMaxBytes(2);
+
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () ->
+                                controller.receive(
+                                        WEBHOOK_ID,
+                                        WebhookSignatures.sign(SECRET, BODY),
+                                        "x.pdf",
+                                        request(BODY)));
+
+        assertEquals(413, ex.getStatusCode().value());
+        assertTrue(spooledFiles().isEmpty());
+    }
+
+    @Test
+    void aDeliveryWithoutAContentLengthIsRejected() {
+        MockHttpServletRequest req =
+                new MockHttpServletRequest("POST", "/api/v1/webhooks/" + WEBHOOK_ID);
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () ->
+                                controller.receive(
+                                        WEBHOOK_ID,
+                                        WebhookSignatures.sign(SECRET, BODY),
+                                        "x.pdf",
+                                        req));
+
+        assertEquals(411, ex.getStatusCode().value());
+        assertTrue(spooledFiles().isEmpty());
+    }
+
+    private List<Path> spooledFiles() {
+        Path dir = spool.dirFor(WEBHOOK_ID);
+        if (!Files.isDirectory(dir)) {
+            return List.of();
+        }
+        try (Stream<Path> entries = Files.list(dir)) {
+            return entries.filter(Files::isRegularFile)
+                    .filter(p -> !p.getFileName().toString().startsWith("."))
+                    .toList();
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookSignaturesTest.java

@@ -0,0 +1,48 @@
+package stirling.software.proprietary.policy.webhook;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+
+import org.junit.jupiter.api.Test;
+
+class WebhookSignaturesTest {
+
+    private static final String SECRET = "whsec_test_secret";
+    private static final byte[] BODY = "the document bytes".getBytes(StandardCharsets.UTF_8);
+
+    @Test
+    void aFreshlySignedBodyVerifies() {
+        String header = WebhookSignatures.sign(SECRET, BODY);
+        assertTrue(header.startsWith("sha256="));
+        assertTrue(WebhookSignatures.verify(SECRET, BODY, header));
+    }
+
+    @Test
+    void abarehexSignatureVerifiesToo() {
+        String header = WebhookSignatures.sign(SECRET, BODY);
+        String bareHex = header.substring("sha256=".length());
+        assertTrue(WebhookSignatures.verify(SECRET, BODY, bareHex));
+    }
+
+    @Test
+    void aWrongSecretDoesNotVerify() {
+        String header = WebhookSignatures.sign(SECRET, BODY);
+        assertFalse(WebhookSignatures.verify("other-secret", BODY, header));
+    }
+
+    @Test
+    void atamperedBodyDoesNotVerify() {
+        String header = WebhookSignatures.sign(SECRET, BODY);
+        byte[] tampered = "the document byteS".getBytes(StandardCharsets.UTF_8);
+        assertFalse(WebhookSignatures.verify(SECRET, tampered, header));
+    }
+
+    @Test
+    void aMissingOrMalformedHeaderIsFalseNotAnError() {
+        assertFalse(WebhookSignatures.verify(SECRET, BODY, null));
+        assertFalse(WebhookSignatures.verify(SECRET, BODY, "sha256=not-hex"));
+        assertFalse(WebhookSignatures.verify(SECRET, BODY, ""));
+    }
+}

app/proprietary/src/test/java/stirling/software/proprietary/util/SecretMaskerTest.java

@@ -103,6 +103,17 @@ class SecretMaskerTest {
             assertEquals("AKIAEXAMPLE", result.get("accessKeyId"));
         }
 
+        @Test
+        @DisplayName("should mask camelCase signingSecret despite no word boundary")
+        void shouldMaskCamelCaseSigningSecret() {
+            Map<String, Object> input = Map.of("signingSecret", "shh", "webhookId", "whk_abc");
+
+            Map<String, Object> result = SecretMasker.mask(input);
+
+            assertEquals(SecretMasker.REDACTED, result.get("signingSecret"));
+            assertEquals("whk_abc", result.get("webhookId"));
+        }
+
         @Test
         @DisplayName("should mask nested map sensitive keys")
         void shouldMaskNestedMapSensitiveKeys() {

frontend/editor/public/locales/en-US/translation.toml

@@ -8041,6 +8041,25 @@ label = "Secret access key"
 [portal.sources.types.unknown]
 label = "Source"
 
+[portal.sources.types.webhook]
+createNote = "A delivery URL and signing secret are generated when you create this webhook. Senders POST documents to that URL and the referencing policies run on arrival."
+description = "Receive documents by signed HTTP POST from any external system."
+label = "Webhook"
+
+[portal.sources.types.webhook.detail]
+deliveryUrl = "Delivery URL"
+secretNote = "The signing secret is shown once, when the webhook is created. Recreate the source to roll it."
+
+[portal.sources.types.webhook.reveal]
+copy = "Copy"
+done = "Done"
+secret = "Signing secret"
+secretHelp = "Sign each delivery's raw body with this key (HMAC-SHA256) and send it as the X-Stirling-Signature header."
+secretWarning = "Copy the signing secret now. For your security it is shown only once and cannot be retrieved later."
+title = "Webhook created"
+url = "Delivery URL"
+usage = "POST each document as the raw request body to the delivery URL with a binary content type (application/pdf or application/octet-stream). Referencing policies run automatically on arrival."
+
 [portal.sources.wizard]
 name = "Name"
 namePlaceholder = "e.g. Claims intake"

frontend/editor/src/portal/api/sources.ts

@@ -32,6 +32,7 @@ export interface SourceView {
   docsTotal: number;
   docs24h: number;
   docs30d: number;
+  webhookPath?: string | null;
 }
 
 export interface SourceKpi {

frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx

@@ -8,6 +8,7 @@
 const PATHS: Record<string, string> = {
   folder: "M3 7h6l2 2h10v9a1 1 0 01-1 1H4a1 1 0 01-1-1V7z",
   s3: "M7 18a4 4 0 010-8 5 5 0 019.6-1.3A3.5 3.5 0 0117 18H7z",
+  webhook: "M13 2L3 14h9l-1 8 10-12h-9l1-8z",
   editor: "M4 20h16M14 4l6 6-9 9H5v-6l9-9z",
   _default:
     "M14 3H7a1 1 0 00-1 1v16a1 1 0 001 1h10a1 1 0 001-1V7l-4-4zM14 3v4h4",

frontend/editor/src/portal/components/sources/sourceTypes.ts

@@ -22,6 +22,9 @@ export interface SourceTypeMeta {
  */
 export const EDITOR_SOURCE_TYPE = "editor";
 
+/** The webhook source type. Its delivery URL + signing secret are minted server-side on create. */
+export const WEBHOOK_SOURCE_TYPE = "webhook";
+
 const SOURCE_TYPE_META: Record<string, SourceTypeMeta> = {
   folder: {
     labelKey: "portal.sources.types.folder.label",
@@ -38,6 +41,11 @@ const SOURCE_TYPE_META: Record<string, SourceTypeMeta> = {
     icon: "☁",
     accent: "brand",
   },
+  webhook: {
+    labelKey: "portal.sources.types.webhook.label",
+    icon: "↯",
+    accent: "warning",
+  },
 };
 
 const UNKNOWN_TYPE_META: SourceTypeMeta = {
@@ -180,6 +188,12 @@ export const CREATABLE_SOURCE_TYPES: CreatableSourceType[] = [
       },
     ],
   },
+  {
+    type: WEBHOOK_SOURCE_TYPE,
+    labelKey: "portal.sources.types.webhook.label",
+    descriptionKey: "portal.sources.types.webhook.description",
+    fields: [],
+  },
 ];
 
 /** Default option values for a type's create form. */

frontend/editor/src/portal/mocks/handlers/sources.ts

@@ -55,6 +55,17 @@ function seedSources(): StoredSource[] {
       enabled: false,
       owner: "data-eng@acme.com",
     },
+    {
+      id: "src-webhook",
+      name: "Partner uploads",
+      type: "webhook",
+      options: {
+        webhookId: "whk_demo_5f3a9c21b7",
+        signingSecret: "whsec_demo_2b8e1d47a9f60c35",
+      },
+      enabled: true,
+      owner: "you@acme.com",
+    },
   ];
 }
 
@@ -76,6 +87,7 @@ const docCounts: Record<
   "src-contracts": { total: 12840, last24h: 96, last30d: 2310 },
   "src-archive": { total: 1180, last24h: 0, last30d: 0 },
   "src-legacy": { total: 48600, last24h: 0, last30d: 0 },
+  "src-webhook": { total: 3120, last24h: 24, last30d: 640 },
 };
 
 function docsFor(id: string): {
@@ -96,14 +108,21 @@ function nextId(): string {
   return `src_${Date.now().toString(36)}_${idCounter}`;
 }
 
+function randomToken(): string {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
 function refsFor(id: string): SourcePolicyRef[] {
   return references[id] ?? [];
 }
 
 function configRows(options: Record<string, unknown>) {
+  const secret = /secret|password|token/i;
   return Object.entries(options).map(([key, value]) => ({
     label: key.charAt(0).toUpperCase() + key.slice(1),
-    value: String(value),
+    value: secret.test(key) ? "********" : String(value),
   }));
 }
 
@@ -120,6 +139,7 @@ function toSourceView(
   refs: SourcePolicyRef[],
 ): SourceView {
   const docs = docsFor(source.id);
+  const webhookId = source.options.webhookId;
   return {
     id: source.id,
     name: source.name,
@@ -131,6 +151,10 @@ function toSourceView(
     docsTotal: docs.total,
     docs24h: docs.last24h,
     docs30d: docs.last30d,
+    webhookPath:
+      source.type === "webhook" && typeof webhookId === "string"
+        ? `/api/v1/webhooks/${webhookId}`
+        : null,
   };
 }
 
@@ -207,8 +231,17 @@ export const sourcesHandlers = [
       ? store.find((s) => s.id === incoming.id)
       : undefined;
     const id = existing?.id ?? nextId();
+    let options = incoming.options ?? {};
+    if (incoming.type === "webhook" && !existing && !options.webhookId) {
+      options = {
+        ...options,
+        webhookId: `whk_${randomToken()}`,
+        signingSecret: `whsec_${randomToken()}`,
+      };
+    }
     const saved: StoredSource = {
       ...incoming,
+      options,
       id,
       owner: existing?.owner ?? "you@acme.com",
     };

frontend/editor/src/portal/views/SourceBuilder.css

@@ -85,3 +85,32 @@
   justify-content: flex-end;
   gap: 0.5rem;
 }
+
+.portal-source-builder__copy-row {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.portal-source-builder__copy-row > :first-child {
+  flex: 1 1 auto;
+  min-width: 0;
+}
+
+.portal-source-builder__reveal {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.portal-source-builder__muted {
+  margin: 0;
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+}
+
+.portal-source-builder__type-description {
+  margin: 0;
+  font-size: 0.875rem;
+  color: var(--color-text-3);
+}

frontend/editor/src/portal/views/SourceBuilder.test.tsx

@@ -102,6 +102,39 @@ describe("SourceBuilder", () => {
     ).toBeDisabled();
   });
 
+  it("reveals the delivery URL and signing secret once after creating a webhook", async () => {
+    createSource.mockResolvedValue({
+      id: "wh-1",
+      options: { webhookId: "whk_abc123", signingSecret: "whsec_topsecret" },
+    });
+    renderBuilder("/processor/sources/new");
+
+    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+      target: { value: "Partner uploads" },
+    });
+    // Webhook's connection is optional (self-hosted local-disk), so a name is enough to create.
+    fireEvent.click(screen.getByText("portal.sources.types.webhook.label"));
+    fireEvent.click(screen.getByText("portal.sources.builder.create"));
+
+    await waitFor(() => expect(createSource).toHaveBeenCalledTimes(1));
+    expect(createSource).toHaveBeenCalledWith(
+      expect.objectContaining({ type: "webhook", name: "Partner uploads" }),
+    );
+
+    expect(
+      await screen.findByDisplayValue("whsec_topsecret"),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByDisplayValue(/\/api\/v1\/webhooks\/whk_abc123$/),
+    ).toBeInTheDocument();
+    expect(screen.queryByText("sources list")).not.toBeInTheDocument();
+
+    fireEvent.click(
+      screen.getByText("portal.sources.types.webhook.reveal.done"),
+    );
+    expect(await screen.findByText("sources list")).toBeInTheDocument();
+  });
+
   it("blocks create until required fields are filled", async () => {
     renderBuilder("/processor/sources/new");
     // Name given but directory (required) still blank -> Create disabled.

frontend/editor/src/portal/views/SourceBuilder.tsx

@@ -27,11 +27,16 @@ import {
   CREATABLE_SOURCE_TYPES,
   defaultOptions,
   sourceTypeMeta,
+  WEBHOOK_SOURCE_TYPE,
   type CreatableSourceType,
 } from "@portal/components/sources/sourceTypes";
 import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
 import "@portal/views/SourceBuilder.css";
 
+function webhookUrl(webhookId: string): string {
+  return `${window.location.origin}/api/v1/webhooks/${webhookId}`;
+}
+
 const OFFERED_TYPES = creatableSourceTypes();
 
 /** A source's stored type resolved to its create-form metadata (edit falls back to any type). */
@@ -84,6 +89,10 @@ export function SourceBuilder() {
   const [error, setError] = useState<string | null>(null);
   const [pendingDelete, setPendingDelete] = useState(false);
   const [deleting, setDeleting] = useState(false);
+  const [reveal, setReveal] = useState<{
+    webhookId: string;
+    secret: string;
+  } | null>(null);
 
   // Seed once: immediately for a new source, or after the record loads for edit.
   useEffect(() => {
@@ -112,18 +121,38 @@ export function SourceBuilder() {
   );
   const canSave = name.trim() !== "" && requiredComplete && !submitting;
 
+  const editingWebhookId =
+    isEdit && sourceState.data?.type === WEBHOOK_SOURCE_TYPE
+      ? String(sourceState.data.options?.webhookId ?? "")
+      : "";
+  const revealUrl = reveal ? webhookUrl(reveal.webhookId) : "";
+  const revealSecret = reveal ? reveal.secret : "";
+
+  function dismissReveal() {
+    setReveal(null);
+    navigate(listPath);
+  }
+
   async function save() {
     if (!canSave) return;
     setSubmitting(true);
     setError(null);
     try {
-      await createSource({
+      const saved = await createSource({
         id: isEdit ? id : undefined,
         name: name.trim(),
         type: type.type,
         options,
         enabled,
       });
+      if (!isEdit && type.type === WEBHOOK_SOURCE_TYPE) {
+        const webhookId = String(saved.options?.webhookId ?? "");
+        const secret = String(saved.options?.signingSecret ?? "");
+        if (webhookId && secret) {
+          setReveal({ webhookId, secret });
+          return;
+        }
+      }
       navigate(listPath);
     } catch (e) {
       setError(errorMessage(e));
@@ -131,6 +160,10 @@ export function SourceBuilder() {
     }
   }
 
+  function copy(text: string) {
+    void navigator.clipboard?.writeText(text);
+  }
+
   async function confirmDelete() {
     if (!id || deleting) return;
     setDeleting(true);
@@ -254,6 +287,18 @@ export function SourceBuilder() {
           </FormField>
         )}
 
+        {!isEdit && (
+          <p className="portal-source-builder__type-description">
+            {t(type.descriptionKey)}
+          </p>
+        )}
+
+        {!isEdit && type.type === WEBHOOK_SOURCE_TYPE && (
+          <p className="portal-source-builder__muted">
+            {t("portal.sources.types.webhook.createNote")}
+          </p>
+        )}
+
         {type.fields.map((field) => (
           <FormField
             key={field.key}
@@ -290,6 +335,28 @@ export function SourceBuilder() {
           </FormField>
         ))}
 
+        {editingWebhookId && (
+          <FormField
+            label={t("portal.sources.types.webhook.detail.deliveryUrl")}
+            helperText={t("portal.sources.types.webhook.detail.secretNote")}
+          >
+            <div className="portal-source-builder__copy-row">
+              <Input
+                value={webhookUrl(editingWebhookId)}
+                readOnly
+                onFocus={(e) => e.currentTarget.select()}
+              />
+              <Button
+                variant="tertiary"
+                size="sm"
+                onClick={() => copy(webhookUrl(editingWebhookId))}
+              >
+                {t("portal.sources.types.webhook.reveal.copy")}
+              </Button>
+            </div>
+          </FormField>
+        )}
+
         {error && <Banner tone="danger" description={error} />}
       </div>
 
@@ -321,6 +388,69 @@ export function SourceBuilder() {
       >
         <p>{t("portal.sources.delete.body", { name })}</p>
       </Modal>
+
+      <Modal
+        open={reveal !== null}
+        onClose={dismissReveal}
+        width="md"
+        title={t("portal.sources.types.webhook.reveal.title")}
+        footer={
+          <div className="portal-source-builder__delete-actions">
+            <Button size="sm" onClick={dismissReveal}>
+              {t("portal.sources.types.webhook.reveal.done")}
+            </Button>
+          </div>
+        }
+      >
+        {reveal && (
+          <div className="portal-source-builder__reveal">
+            <Banner
+              tone="warning"
+              description={t(
+                "portal.sources.types.webhook.reveal.secretWarning",
+              )}
+            />
+            <FormField label={t("portal.sources.types.webhook.reveal.url")}>
+              <div className="portal-source-builder__copy-row">
+                <Input
+                  value={revealUrl}
+                  readOnly
+                  onFocus={(e) => e.currentTarget.select()}
+                />
+                <Button
+                  variant="tertiary"
+                  size="sm"
+                  onClick={() => copy(revealUrl)}
+                >
+                  {t("portal.sources.types.webhook.reveal.copy")}
+                </Button>
+              </div>
+            </FormField>
+            <FormField
+              label={t("portal.sources.types.webhook.reveal.secret")}
+              helperText={t("portal.sources.types.webhook.reveal.secretHelp")}
+            >
+              <div className="portal-source-builder__copy-row">
+                <Input
+                  value={revealSecret}
+                  readOnly
+                  onFocus={(e) => e.currentTarget.select()}
+                />
+                <Button
+                  variant="tertiary"
+                  size="sm"
+                  onClick={() => copy(revealSecret)}
+                >
+                  {t("portal.sources.types.webhook.reveal.copy")}
+                </Button>
+              </div>
+            </FormField>
+            <p className="portal-source-builder__muted">
+              {t("portal.sources.types.webhook.reveal.usage")}
+            </p>
+          </div>
+        )}
+      </Modal>
     </div>
   );
 }

frontend/editor/src/portal/views/Sources.css

@@ -95,6 +95,11 @@
 .portal-sources__type-dot--warning {
   --dot-c: var(--color-amber-dark);
 }
+/* Dark: subtle tint + bright icon; amber-light/amber-dark are too close to read. */
+[data-theme="dark"] .portal-sources__type-dot--warning {
+  background: color-mix(in srgb, var(--color-amber) 20%, transparent);
+  color: var(--color-amber);
+}
 .portal-sources__type-dot--danger {
   --dot-c: var(--color-red-dark);
 }

testing/cucumber/features/environment.py

@@ -19,6 +19,9 @@ _JWT_DEPENDENT_TAGS = frozenset({
     "jwt", "user_mgmt", "admin_settings", "audit", "signature", "team",
 })
 
+# Tags for scenarios that require the policies feature (policies.enabled=true).
+_POLICIES_DEPENDENT_TAGS = frozenset({"policies", "webhook"})
+
 
 def _check_jwt_available():
     """Probe the server to determine whether JWT Bearer auth is functional.
@@ -85,6 +88,38 @@ def _capture_docker_logs_window(start_line, scenario_name):
         pass
 
 
+def _check_policies_available():
+    """Probe whether webhook sources can be created (proprietary policy feature).
+
+    Creates a throwaway webhook source: a 200 with a minted webhookId means the
+    webhook beans are present (a proprietary build). The probe source is
+    best-effort deleted afterwards.
+    """
+    try:
+        resp = requests.post(
+            f"{_BASE_URL}/api/v1/sources",
+            headers={"X-API-KEY": "123456789", "Content-Type": "application/json"},
+            json={"name": "policies-probe", "type": "webhook", "options": {}, "enabled": True},
+            timeout=10,
+        )
+        if resp.status_code != 200:
+            return False
+        source_id = resp.json().get("id")
+        has_webhook = bool(resp.json().get("options", {}).get("webhookId"))
+        if source_id:
+            try:
+                requests.delete(
+                    f"{_BASE_URL}/api/v1/sources/{source_id}",
+                    headers={"X-API-KEY": "123456789"},
+                    timeout=10,
+                )
+            except Exception:
+                pass
+        return has_webhook
+    except Exception:
+        return False
+
+
 def before_all(context):
     context.endpoint = None
     context.request_data = None
@@ -97,6 +132,12 @@ def before_all(context):
             "(server likely running with V2=false). "
             "Scenarios tagged with JWT-dependent tags will be skipped."
         )
+    context.policies_available = _check_policies_available()
+    if not context.policies_available:
+        print(
+            "\n[POLICIES] Webhook sources are not available in this environment "
+            "(e.g. a core-only build). Scenarios tagged @policies/@webhook will be skipped."
+        )
 
 
 def before_scenario(context, scenario):
@@ -110,6 +151,13 @@ def before_scenario(context, scenario):
         )
         return
 
+    if _POLICIES_DEPENDENT_TAGS & scenario_tags and not context.policies_available:
+        scenario.skip(
+            "Webhook sources not available in this environment (e.g. a core-only build). "
+            "Run against a proprietary build to execute these scenarios."
+        )
+        return
+
     context.files = {}
     context.multi_files = []
     context.json_parts = {}

testing/cucumber/features/steps/webhook_step_definitions.py

@@ -0,0 +1,84 @@
+import hashlib
+import hmac
+
+import requests
+from behave import given, when, then
+
+BASE_URL = "http://localhost:8080"
+API_HEADERS = {"X-API-KEY": "123456789"}
+
+
+def _sign(secret, body):
+    digest = hmac.new(secret.encode(), body.encode(), hashlib.sha256).hexdigest()
+    return "sha256=" + digest
+
+
+@given('I create a webhook source named "{name}"')
+def step_create_webhook_source(context, name):
+    resp = requests.post(
+        f"{BASE_URL}/api/v1/sources",
+        headers={**API_HEADERS, "Content-Type": "application/json"},
+        json={"name": name, "type": "webhook", "options": {}, "enabled": True},
+        timeout=15,
+    )
+    assert resp.status_code == 200, f"create source failed: {resp.status_code} {resp.text}"
+    context.webhook_create_response = resp
+    body = resp.json()
+    context.webhook_source_id = body["id"]
+    context.webhook_id = body["options"]["webhookId"]
+    context.webhook_secret = body["options"]["signingSecret"]
+
+
+@when('I deliver "{payload}" to the webhook with a valid signature')
+def step_deliver_signed(context, payload):
+    signature = _sign(context.webhook_secret, payload)
+    context.webhook_response = requests.post(
+        f"{BASE_URL}/api/v1/webhooks/{context.webhook_id}",
+        headers={"Content-Type": "application/pdf", "X-Stirling-Signature": signature},
+        data=payload.encode(),
+        timeout=15,
+    )
+
+
+@when('I deliver "{payload}" to the webhook with signature "{signature}"')
+def step_deliver_with_signature(context, payload, signature):
+    context.webhook_response = requests.post(
+        f"{BASE_URL}/api/v1/webhooks/{context.webhook_id}",
+        headers={"Content-Type": "application/pdf", "X-Stirling-Signature": signature},
+        data=payload.encode(),
+        timeout=15,
+    )
+
+
+@when('I deliver "{payload}" to webhook id "{webhook_id}"')
+def step_deliver_to_id(context, payload, webhook_id):
+    context.webhook_response = requests.post(
+        f"{BASE_URL}/api/v1/webhooks/{webhook_id}",
+        headers={"Content-Type": "application/pdf", "X-Stirling-Signature": "sha256=00"},
+        data=payload.encode(),
+        timeout=15,
+    )
+
+
+@then("the webhook response status should be {status:d}")
+def step_check_status(context, status):
+    actual = context.webhook_response.status_code
+    assert actual == status, f"expected {status}, got {actual}: {context.webhook_response.text}"
+
+
+@then("the webhook create response includes a signing secret")
+def step_secret_present(context):
+    secret = context.webhook_create_response.json()["options"].get("signingSecret", "")
+    assert secret and secret != "********", f"expected a revealed secret, got '{secret}'"
+
+
+@then("reading the webhook source back masks the signing secret")
+def step_secret_masked(context):
+    resp = requests.get(
+        f"{BASE_URL}/api/v1/sources/{context.webhook_source_id}",
+        headers=API_HEADERS,
+        timeout=15,
+    )
+    assert resp.status_code == 200, f"get source failed: {resp.status_code} {resp.text}"
+    secret = resp.json()["options"].get("signingSecret", "")
+    assert secret != context.webhook_secret, "secret was returned in clear text on read"

testing/cucumber/features/webhook_source.feature

@@ -0,0 +1,25 @@
+@policies @webhook
+Feature: Webhook input source
+  # Requires the proprietary policy feature (webhook sources). Scenarios are
+  # skipped automatically when webhook sources are unavailable (see environment.py).
+  # A webhook source mints a delivery URL + signing secret; senders POST signed
+  # documents which are spooled for the referencing policies.
+
+  Scenario: A validly signed delivery is accepted
+    Given I create a webhook source named "Cucumber webhook"
+    When I deliver "hello from cucumber" to the webhook with a valid signature
+    Then the webhook response status should be 202
+
+  Scenario: A wrongly signed delivery is rejected
+    Given I create a webhook source named "Cucumber webhook reject"
+    When I deliver "tampered body" to the webhook with signature "sha256=deadbeef"
+    Then the webhook response status should be 401
+
+  Scenario: Delivering to an unknown webhook id is not found
+    When I deliver "orphan" to webhook id "doesnotexistwebhook0"
+    Then the webhook response status should be 404
+
+  Scenario: The signing secret is revealed once on create then masked on read
+    Given I create a webhook source named "Cucumber webhook secret"
+    Then the webhook create response includes a signing secret
+    And reading the webhook source back masks the signing secret