[BenAbdou1001]

Closes #240

What and why

Adds GET /api/project/inbound-webhooks/:id/submissions/:submissionId under ApiKeyGuard with the read_inbound_submissions scope, so the Event Platform can re-read one submission of its own webhook without paging. Returns the same fields as a list item (id, payload, receivedAt, origin). Another project's webhook, another webhook's submission and an unknown id are all 404; a non-UUID submission id is 400.

Acceptance criteria

• Own submission is returned: getSubmissionForProject unit spec, controller spec, e2e spec
• Other project / unknown id gives 404: unit spec and e2e spec
• Read is audited (submissions.read, not audited on 404): unit and e2e specs
• Documented, OpenAPI reference regenerated: pnpm docs:api, reading-submissions.mdx

How it was checked

• pnpm --filter @mcid/api exec jest: 111 suites, 1423 tests pass
• pnpm turbo run lint typecheck --filter=@mcid/api: pass
• pnpm --filter @mcid/web exec vitest run tests/features/docs tests/app/docs-routes.test.tsx: pass
• Not run: API e2e (no local Postgres); the new e2e cases are in test/inbound-webhook-project-submissions.e2e-spec.ts and run in CI.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
mcid	Skipped		Nov 5, 2026 3:16pm UTC

[BenAbdou1001]

Review of #260 (issue #240, EP-03)

Acceptance criteria

• Own submission is returned with the list fields only (id, payload, receivedAt, origin; ipAddress/userAgent are not leaked): getSubmissionForProject unit spec, controller spec, e2e asserts the exact key set.
• Other project / unknown id is 404, never saying which: the webhook ownership check runs before the lookup, and findSubmission filters on webhookId, so a foreign submission under an own webhook is 404 too. Covered in unit and e2e specs (own webhook + foreign sub, foreign webhook, unknown UUID).
• Read is audited (submissions.read, viaApiKey: true, not audited on 404), same as the list endpoint.
• Documented, OpenAPI regenerated: reading-submissions.mdx section added, pnpm docs:api gives no diff.
• 401/403/429 from ApiKeyGuard, @RequireScope('read_inbound_submissions') and the class-level ProjectThrottlerGuard; non-UUID submission id is 400 via ParseUUIDPipe.

Issue found and fixed

• CI lint-and-test failed: apps/cli/src/generated/api.d.ts was not regenerated after the OpenAPI change. Fixed in f0bb160 (pnpm --filter mcid-cli generate:api-types).

Validation (local)

• jest src/modules/inbound-webhooks: 15 suites, 230 tests pass
• turbo run typecheck lint --filter=@mcid/api: pass, no lint fixes
• pnpm docs:api: no diff; docs vitest: 716 pass
• CLI typecheck and vitest: 311 pass
• Not run locally: API e2e (Docker not running). The new e2e cases run in CI once lint-and-test is green.

Non-blocking

• ProjectServerQueryDto duplicates the serverId field of ListProjectSubmissionsDto; the list DTO could extend it. Left as is.
• Closes #240 will not auto-close the issue since the base is dev; close it manually after merge.

Verdict: COMMENT (own PR, GitHub refuses self-approval). Ready once CI is green.