I've protected this endpoint with a feature flag, and an authentication class, as it will be exposed on the public internet. I've tried to keep the viewset logic as minimal as possible, I've to ship smth and will continue iterating on this piece of code. At some point, abstracting webhook endpoint and authentication class might be beneficial for the project. YAGNI as of today.