How do I validate the X-Sentry-Hook-Signature header?

Independent of the body schema. Verify HMAC-SHA256 of the raw bytes with your client secret first, then v.parse the parsed body. Two layers: signature proves origin; the schema proves shape.

Can I narrow on action and event type?

Yes. Compose with v.variant on action (created, resolved, ...) and a nested v.variant on data type if your handler dispatches by inner event.

JSON→TypeScript

Sentry Event to Valibot

Paste a sentry event JSON payload and get a Valibot v.object schema you can run inside your handler. Smaller bundle than Zod, same boundary guarantee — useful for Cloudflare Workers, Vercel Edge, and any runtime where bundle size matters.

JSON input valid

Valibot output

About this conversion

Sentry webhooks differ sharply by event type (issue.created vs error.created vs metric_alert.critical) — a parse at the /sentry-webhook endpoint forces you to handle the right variant for the action and event type, instead of unsafely indexing into data.issue when the actual payload is data.error.

If you proxy Sentry webhooks through a Cloudflare Worker (signing-key check + forward to a queue), the Worker has a 1 MB compiled-script cap — Valibot fits comfortably under that with room to add discriminated-variant logic for action / event-type cases. The output is a copy-paste-runnable v.object using the canonical namespace import (import * as v from "valibot"); only the primitives your shape actually uses (v.string, v.number, v.array, v.union, v.optional) get pulled in.

Sentry Event to Valibot

About this conversion

Same shape, other validators

Other JSON shapes