You can create a published rest service, point that to a microflow with a System.HttpRequest input parameter and then in the flow do the validation on HttpRequest.Content. You can retrieve the headers and find the right one using the find by expression list activity and condition something like
toLowerCase($currentObject/Key) = 'x-xero-signature'
Then if the content is validated you can do your import mapping on the HttpRequest.
You can also add a System.HttpResponse input parameter in the flow and change its StatusCode to 401 if the validation falis. Mendix will automatically populate the request and response parameters.