> ## Documentation Index > Fetch the complete documentation index at: https://docs.praxis-ai.com/llms.txt > Use this file to discover all available pages before exploring further. # GitHub Marketplace webhook receiver > Receives `marketplace_purchase` events from GitHub when an org or user purchases, upgrades, downgrades, or cancels the Pria Marketplace listing. The endpoint validates the request via the `X-Hub-Signature-256` HMAC header (computed by GitHub with `GITHUB_WEBHOOK_SECRET`), then dispatches by `action` (`purchased`, `changed`, `cancelled`, `pending_change`, `pending_change_cancelled`). On a new purchase the handler auto-creates the Pria user (via `autosignup`), generates a one-time login link (`?otp=` in the URL since the link is delivered by email — see `docs/index/oauth-otp.md`), and emails it to the purchaser. **Authentication:** none in the traditional sense — request authenticity is proven by the `X-Hub-Signature-256` HMAC, compared with `crypto.timingSafeEqual`. Requests with a missing or wrong signature are rejected with 401. Application errors that occur *after* signature validation still return 200 so GitHub does not retry; the failure is surfaced via internal email instead. ## OpenAPI ````yaml /mdx/api-reference/admin/admin-api.json post /api/auth/github/webhook openapi: 3.0.0 info: title: Pria Admin API version: 2.0.1 description: >- Pria API Documentation Praxis's developer platform is a core part of our mission to empower organizations to grow better. Our APIs are designed to enable teams of any shape or size to build robust integrations that help them customize and get the most value out of Pria. All Pria APIs are built using REST conventions and designed to have a predictable URL structure.

They use many standard HTTP features, including methods (POST, GET, PUT, DELETE) and error response codes.

All API calls are made under https://hiimpria.ai/api and all responses return standard JSON. In these docs, you'll find lists of all available endpoints for a given API, along with interactive code blocks for building requests. For walkthroughs of basic usage for these APIs, check out the API guides. servers: - url: https://pria.praxislxp.com description: Pria API Server security: [] tags: - name: Authentication description: User authentication, registration, and password management (/api/auth) - name: OAuth description: OAuth authentication providers - Google, GitHub, SSO (/api/auth/oauth) - name: User description: User profile management and account operations (/api/user) - name: User Institutions description: User institution memberships and switching (/api/user/institution) - name: User Tools description: Available tools for authenticated users (/api/user/tools) - name: Institutions description: Institution settings and configuration (/api/user/institution) - name: Conversation description: AI conversation and Q&A endpoints (/api/ai) - name: Realtime description: Real-time voice AI and WebRTC sessions (/api/ai/rt) - name: Assistant description: AI assistant configuration and management (/api/user/assistant) - name: History description: Conversation history and favorites (/api/user/history) - name: RAG description: >- Document upload, embedding, and retrieval-augmented generation (/api/user/files, /api/user/rag) - name: Setting description: Instance variables and settings management (/api/user/setting) - name: Branding description: Digital twin branding and customization (/api/agent/branding) - name: Agent description: Agent engagement and session management (/api/agent) - name: SDK Launch description: >- SDK launch token signing and verification for secure iframe embedding (/api/auth/sdk-sign, /api/auth/sdk-verify) - name: Testing description: Health checks, diagnostics, and test endpoints (/api/test) - name: Admin Accounts description: Account management for super admins (/api/admin/account) - name: Admin Institutions description: Institution management for admins (/api/admin/institution) - name: Admin Users description: User management for admins (/api/admin/user) - name: Admin Entitlements description: >- User-institution relationships and permissions (/api/admin/userInstitution) - name: Admin Sessions description: Session management for admins (/api/admin/session) - name: Admin Histories description: Conversation history management and analytics (/api/admin/history) - name: Admin Assistants description: AI assistant management for admins (/api/admin/assistant) - name: Admin Questions description: Institution question and prompt management (/api/admin/question) - name: Admin Tools description: Tool configuration management (/api/admin/tool) - name: Admin AI Models description: AI model configuration (/api/admin/aimodel) - name: Admin MCP Servers description: Model Context Protocol server management (/api/admin/mcpserver) - name: Admin Feedbacks description: User feedback management (/api/admin/feedback) - name: Admin Uploads description: Upload management (/api/admin/upload) - name: Admin Charts description: Analytics and visualization chart management (/api/admin/chart) - name: Admin Memory description: Admin inspection and editing of user/instance memory parameters. - name: Admin Usage Limits description: Per-user usage-vs-cap reporting and account-wide at-limit counts. paths: /api/auth/github/webhook: post: tags: - OAuth summary: GitHub Marketplace webhook receiver description: > Receives `marketplace_purchase` events from GitHub when an org or user purchases, upgrades, downgrades, or cancels the Pria Marketplace listing. The endpoint validates the request via the `X-Hub-Signature-256` HMAC header (computed by GitHub with `GITHUB_WEBHOOK_SECRET`), then dispatches by `action` (`purchased`, `changed`, `cancelled`, `pending_change`, `pending_change_cancelled`). On a new purchase the handler auto-creates the Pria user (via `autosignup`), generates a one-time login link (`?otp=` in the URL since the link is delivered by email — see `docs/index/oauth-otp.md`), and emails it to the purchaser. **Authentication:** none in the traditional sense — request authenticity is proven by the `X-Hub-Signature-256` HMAC, compared with `crypto.timingSafeEqual`. Requests with a missing or wrong signature are rejected with 401. Application errors that occur *after* signature validation still return 200 so GitHub does not retry; the failure is surfaced via internal email instead. parameters: - in: header name: X-Hub-Signature-256 required: true schema: type: string description: HMAC-SHA256 of the raw request body, prefixed with `sha256=`. example: sha256=a1b2c3d4... - in: header name: X-GitHub-Event schema: type: string description: >- GitHub event type. Only `marketplace_purchase` is acted on; everything else is logged and acknowledged. example: marketplace_purchase - in: header name: X-GitHub-Delivery schema: type: string description: Per-delivery UUID assigned by GitHub (for log correlation). requestBody: required: true description: > Raw GitHub Marketplace payload. The handler reads `req.body` as a Buffer and JSON-parses after signature verification. See GitHub's marketplace_purchase documentation for the full shape. content: application/json: schema: type: object properties: action: type: string enum: - purchased - changed - cancelled - pending_change - pending_change_cancelled example: purchased effective_date: type: string format: date-time sender: type: object properties: login: type: string id: type: integer type: type: string email: type: string nullable: true avatar_url: type: string marketplace_purchase: type: object properties: account: type: object plan: type: object billing_cycle: type: string unit_count: type: integer on_free_trial: type: boolean free_trial_ends_on: type: string nullable: true next_billing_date: type: string responses: '200': description: > Webhook accepted. The handler always returns 200 once the signature passes — even if the downstream business logic threw — so GitHub does not retry. On internal failures the response includes `error`. content: application/json: schema: type: object properties: received: type: boolean example: true error: type: string description: Present only when post-signature processing threw. '401': description: > Missing `X-Hub-Signature-256` header, or the signature does not match `HMAC_SHA256(GITHUB_WEBHOOK_SECRET, body)`. content: application/json: schema: type: object properties: error: type: string example: Invalid signature ````