BrainBank
AI Classroom/Step by StepPalantir

Product Lifecycle - Listeners (HTTPS)

7/13/2026, 4:28:05 PM

#step-by-step#palantir-foundry#data-connection#webhooks#event-streaming#data-ingestion

Palantir Foundry's HTTPS Listeners enable secure, low-latency ingestion of inbound webhook events from external systems by handling platform-specific signature verification and endpoint rotation.

Listeners (HTTPS)

The HTTPS Listeners feature, new to Data Connection, enables you to receive inbound webhook events directly into the Palantir platform. This feature is now generally available. Integrating real-time events from external systems into Foundry has traditionally been challenging when those systems lack OAuth 2.0 authentication support or cannot format payloads to match standard Foundry API endpoints. Listeners address this gap by provisioning HTTPS endpoints that implement system-specific message signing and verification schemes—agnostic to data shape—providing a simple, low-latency mechanism to accept event streams from external sources.

Select from Data Connection's supported listeners to configure and receive inbound webhook events.Select from Data Connection's supported listeners to configure and receive inbound webhook events.Select from Data Connection's supported listeners to configure and receive inbound webhook events.

How listeners work

To accept inbound events from external systems, Data Connection listeners provision a URL endpoint, implement the specific message signing or other verification schemes for specific external systems, and allow for receiving event streams in the Palantir platform. Leverage the listener output stream with streaming pipelines, automations, or batch analysis to create powerful event-processing workflows.

Subdomain configuration and zero-downtime endpoint rotation

You can generate a subdomain for your listener to establish a distinct address with a wider range of network ingress compared to the rest of your Foundry enrollment. This isolates webhook traffic from other platform operations, provides additional control over external system connections, and enables unified governance with security benefits.  Listeners also come with an endpoint rotation capability that provides protection if a listener endpoint is compromised. Migrate to a new endpoint with zero downtime if the URL is accidentally exposed. When rotating your endpoint, you can set an expiration date for seamless zero-downtime transitions, or delete the old endpoint immediately if faster action is required. Once an endpoint expires, it will no longer process events. Data Connection listeners expand Foundry's integration capabilities by removing authentication and payload formatting barriers that previously prevented real-time event ingestion from external systems. 

Supported listeners

The Palantir platform currently provides support for the following listeners:

Learning map

Stage 1: Core Webhook Concepts

  • HTTP Push Architecture: Understand how webhook endpoints receive real-time push events compared to pull-based API polling.
  • Cryptographic Signatures: Learn how payload verification mechanisms (like HMAC) work to secure public endpoints.

Stage 2: Foundry Listener Integration

  • Data Connection Interface: Learn how to spin up built-in listeners for third-party platforms (e.g., GitHub, Slack, Stripe).
  • Subdomain Configuration: Practice isolating inbound webhook traffic using dedicated subdomains for unified governance.

Stage 3: Real-Time Stream Engineering

  • Pipeline Integration: Connect active listener streams to real-time pipelines, automations, and batch analysis.
  • Zero-Downtime URL Rotation: Master migrating compromised endpoints to new URLs seamlessly without dropping active data packets.

Get hands-on — step by step

  1. Navigate to Data Connection: Open your Palantir Foundry workspace, open the Data Connection application, and click on New Listener.

  2. Select and Configure your Source: Choose a platform from the list of supported providers (e.g., GitHub or Stripe). Assign a distinct subdomain to route your webhook traffic through dedicated ingress.

  3. Retrieve and Deploy Secrets: Copy the generated secure URL endpoint and the secret verification key provided by Foundry.

  4. Register Webhook in the External System: Log into your source platform (e.g., GitHub repository settings), navigate to Webhooks, click Add Webhook, paste the listener URL, and enter your secret key.

  5. Verify Event Ingestion: Generate a mock event in the source system (e.g., open a test pull request or submit a mock payment). Go back to Foundry and open the listener's dataset explorer to watch the raw streaming events arrive.

  6. Practice Zero-Downtime Rotation: In the listener settings, select Rotate Endpoint. Assign an expiration timeframe for your old URL, update the webhook URL inside your external system to the new URL, and confirm traffic seamlessly transitions before the old URL expires.

Top 3 sources

  1. 1
    GitHub Webhooks Documentation

    An excellent standard guide to learning how webhook events, payloads, and cryptographic signatures operate in modern APIs.

    https://docs.github.com/en/webhooks/about-webhooks

  2. 2
    Palantir Apollo Notifications Overview

    Official documentation covering how Palantir coordinates real-time system alerts, events, and webhook targets.

    https://www.palantir.com/docs/apollo/managing-notifications/overview/

  3. 3
    Stripe Webhooks Guide

    A highly practical and widely-referenced walkthrough detailing how secure webhook signatures are processed and verified programmatically.

    https://docs.stripe.com/webhooks

Links are AI-suggested — worth a quick sanity check before diving in.