feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON
POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints
change, filtered by event or family. Deliveries are retried a couple of
times, the last one is shown, and a ping can be sent from the settings.
Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
2026-10-08 15:36:19 +02:00
parent 046d77c813
commit d43fc620e9
37 changed files with 3660 additions and 28 deletions

View File

@@ -7871,6 +7871,534 @@
],
"security": []
}
},
"/api/webhook-events": {
"get": {
"operationId": "WebhooksController_events",
"parameters": [],
"responses": {
"200": {
"description": "",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
},
"security": [
{
"pireon-oauth": []
},
{
"pireon": []
}
],
"summary": "Event names a webhook can subscribe to",
"tags": [
"Webhooks"
]
}
},
"/api/projects/{project}/webhooks": {
"get": {
"operationId": "WebhooksController_list",
"parameters": [
{
"name": "project",
"required": true,
"in": "path",
"description": "Project id or key",
"schema": {
"example": "WEB",
"type": "string"
}
}
],
"responses": {
"200": {
"description": "",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WebhookDto"
}
}
}
}
},
"400": {
"description": "Invalid input",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"401": {
"description": "Missing or rejected Pireon token",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"403": {
"description": "Not a member of the project (or not allowed)",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
}
},
"security": [
{
"pireon-oauth": []
},
{
"pireon": []
}
],
"summary": "The project's webhooks (owners and admins)",
"tags": [
"Webhooks"
]
},
"post": {
"description": "The answer carries the secret, the only time it is shown.",
"operationId": "WebhooksController_create",
"parameters": [
{
"name": "project",
"required": true,
"in": "path",
"description": "Project id or key",
"schema": {
"example": "WEB",
"type": "string"
}
}
],
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CreateWebhookDto"
}
}
}
},
"responses": {
"201": {
"description": "",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/WebhookCreatedDto"
}
}
}
},
"400": {
"description": "Invalid input",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"401": {
"description": "Missing or rejected Pireon token",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"403": {
"description": "Not a member of the project (or not allowed)",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"409": {
"description": "Someone changed it at the same time: retry",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"422": {
"description": "Business rule (e.g. a transition the workflow forbids)",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
}
},
"security": [
{
"pireon-oauth": []
},
{
"pireon": []
}
],
"summary": "Add a webhook",
"tags": [
"Webhooks"
]
}
},
"/api/outgoing-webhooks/{webhook}": {
"patch": {
"operationId": "WebhooksController_update",
"parameters": [
{
"name": "webhook",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"type": "string"
}
}
],
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UpdateWebhookDto"
}
}
}
},
"responses": {
"200": {
"description": "",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/WebhookDto"
}
}
}
},
"400": {
"description": "Invalid input",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"401": {
"description": "Missing or rejected Pireon token",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"403": {
"description": "Not a member of the project (or not allowed)",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"409": {
"description": "Someone changed it at the same time: retry",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"422": {
"description": "Business rule (e.g. a transition the workflow forbids)",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
}
},
"security": [
{
"pireon-oauth": []
},
{
"pireon": []
}
],
"summary": "Change the URL or the events, pause or resume",
"tags": [
"Webhooks"
]
},
"delete": {
"operationId": "WebhooksController_delete",
"parameters": [
{
"name": "webhook",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"type": "string"
}
}
],
"responses": {
"204": {
"description": ""
},
"400": {
"description": "Invalid input",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"401": {
"description": "Missing or rejected Pireon token",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"403": {
"description": "Not a member of the project (or not allowed)",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"409": {
"description": "Someone changed it at the same time: retry",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"422": {
"description": "Business rule (e.g. a transition the workflow forbids)",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
}
},
"security": [
{
"pireon-oauth": []
},
{
"pireon": []
}
],
"summary": "Delete a webhook",
"tags": [
"Webhooks"
]
}
},
"/api/outgoing-webhooks/{webhook}/test": {
"post": {
"operationId": "WebhooksController_test",
"parameters": [
{
"name": "webhook",
"required": true,
"in": "path",
"schema": {
"format": "uuid",
"type": "string"
}
}
],
"responses": {
"200": {
"description": "",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/WebhookDeliveryDto"
}
}
}
},
"400": {
"description": "Invalid input",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"401": {
"description": "Missing or rejected Pireon token",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"403": {
"description": "Not a member of the project (or not allowed)",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"409": {
"description": "Someone changed it at the same time: retry",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
},
"422": {
"description": "Business rule (e.g. a transition the workflow forbids)",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiErrorDto"
}
}
}
}
},
"security": [
{
"pireon-oauth": []
},
{
"pireon": []
}
],
"summary": "Send a ping now and tell how it went",
"tags": [
"Webhooks"
]
}
}
},
"info": {
@@ -10815,6 +11343,154 @@
"required": [
"recorded"
]
},
"WebhookDeliveryDto": {
"type": "object",
"properties": {
"at": {
"type": "string",
"format": "date-time"
},
"event": {
"type": "string",
"example": "issue.created"
},
"status": {
"type": "number",
"nullable": true,
"description": "HTTP status"
},
"ok": {
"type": "boolean"
},
"error": {
"type": "string",
"nullable": true
}
},
"required": [
"at",
"event",
"status",
"ok",
"error"
]
},
"WebhookDto": {
"type": "object",
"properties": {
"id": {
"type": "string",
"format": "uuid"
},
"projectId": {
"type": "string",
"format": "uuid"
},
"url": {
"type": "string"
},
"events": {
"type": "array",
"items": {
"type": "string"
}
},
"active": {
"type": "boolean"
},
"createdBy": {
"$ref": "#/components/schemas/UserRefDto"
},
"createdAt": {
"type": "string",
"format": "date-time"
},
"lastDelivery": {
"nullable": true,
"type": "object",
"allOf": [
{
"$ref": "#/components/schemas/WebhookDeliveryDto"
}
]
}
},
"required": [
"id",
"projectId",
"url",
"events",
"active",
"createdBy",
"createdAt",
"lastDelivery"
]
},
"CreateWebhookDto": {
"type": "object",
"properties": {
"url": {
"type": "string",
"example": "https://chat.example.org/hooks/taskstream"
},
"events": {
"example": [
"issue.status_changed",
"release.*"
],
"description": "Event names (GET /api/webhook-events), family.* or *",
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"url",
"events"
]
},
"WebhookCreatedDto": {
"type": "object",
"properties": {
"id": {
"type": "string",
"format": "uuid"
},
"secret": {
"type": "string",
"description": "Signs every delivery. Shown only now."
}
},
"required": [
"id",
"secret"
]
},
"UpdateWebhookDto": {
"type": "object",
"properties": {
"url": {
"type": "string",
"example": "https://chat.example.org/hooks/taskstream"
},
"events": {
"example": [
"issue.status_changed",
"release.*"
],
"description": "Event names (GET /api/webhook-events), family.* or *",
"type": "array",
"items": {
"type": "string"
}
},
"active": {
"type": "boolean",
"description": "Paused webhooks get nothing"
}
}
}
}
}

View File

@@ -190,6 +190,13 @@ input CreateSprintInput {
startDate: String!
}
input CreateWebhookInput {
"""Event names, family.* or *"""
events: [String!]!
projectId: ID!
url: String!
}
type CreatedResolved {
created: Int!
resolved: Int!
@@ -465,6 +472,7 @@ type Mutation {
"""Plan a sprint (owners and admins)"""
createSprint(input: CreateSprintInput!): CommandResult!
createWebhook(input: CreateWebhookInput!): WebhookCreated!
"""Author or project admin"""
deleteComment(commentId: ID!): CommandResult!
@@ -479,6 +487,7 @@ type Mutation {
"""Delete a sprint that never started; its tickets go back to the backlog"""
deleteSprint(sprintId: ID!): CommandResult!
deleteWebhook(webhookId: ID!): Boolean!
disableGitIntegration(projectId: ID!): Boolean!
editComment(body: String!, commentId: ID!): CommandResult!
@@ -522,6 +531,9 @@ type Mutation {
"""Start a planned sprint (only one under way per project)"""
startSprint(sprintId: ID!): CommandResult!
"""Send a ping now and tell how it went"""
testWebhook(webhookId: ID!): WebhookDelivery!
unlinkIssues(input: LinkIssuesInput!): CommandResult!
"""Stop following a ticket"""
@@ -539,6 +551,7 @@ type Mutation {
updateProjectSettings(projectId: ID!, settings: ProjectSettingsInput!): CommandResult!
updateRelease(input: UpdateReleaseInput!): CommandResult!
updateSprint(input: UpdateSprintInput!): CommandResult!
updateWebhook(input: UpdateWebhookInput!): Webhook!
"""
Follow a ticket: be told when it moves, is reassigned or gets a comment
@@ -776,6 +789,10 @@ type Query {
"""Search users by name or email (to assign / add members)"""
users(limit: Int! = 20, search: String! = ""): [User!]!
"""Event names a webhook can subscribe to (also family.* and *)"""
webhookEvents: [String!]!
webhooks(projectId: ID!): [Webhook!]!
}
input RankIssueInput {
@@ -1053,6 +1070,13 @@ input UpdateSprintInput {
startDate: String
}
input UpdateWebhookInput {
active: Boolean
events: [String!]
url: String
webhookId: ID!
}
"""User managed by the Pireon identity server"""
type User {
email: String!
@@ -1066,6 +1090,39 @@ type UserRef {
name: String!
}
"""
Where the project tells another system what happened (signed POST, HMAC-SHA256)
"""
type Webhook {
active: Boolean!
createdAt: String!
createdBy: UserRef!
"""Event names, family.* or *"""
events: [String!]!
id: ID!
lastDelivery: WebhookDelivery
projectId: ID!
url: String!
}
type WebhookCreated {
id: ID!
"""Signs every delivery. Shown only now: keep it."""
secret: String!
}
type WebhookDelivery {
at: String!
error: String
event: String!
ok: Boolean!
"""HTTP status"""
status: Int
}
type WorkflowStatus {
"""No new tickets or transitions into it"""
archived: Boolean!

View File

@@ -1136,6 +1136,79 @@ export interface paths {
patch?: never;
trace?: never;
};
"/api/webhook-events": {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
/** Event names a webhook can subscribe to */
get: operations["WebhooksController_events"];
put?: never;
post?: never;
delete?: never;
options?: never;
head?: never;
patch?: never;
trace?: never;
};
"/api/projects/{project}/webhooks": {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
/** The project's webhooks (owners and admins) */
get: operations["WebhooksController_list"];
put?: never;
/**
* Add a webhook
* @description The answer carries the secret, the only time it is shown.
*/
post: operations["WebhooksController_create"];
delete?: never;
options?: never;
head?: never;
patch?: never;
trace?: never;
};
"/api/outgoing-webhooks/{webhook}": {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
get?: never;
put?: never;
post?: never;
/** Delete a webhook */
delete: operations["WebhooksController_delete"];
options?: never;
head?: never;
/** Change the URL or the events, pause or resume */
patch: operations["WebhooksController_update"];
trace?: never;
};
"/api/outgoing-webhooks/{webhook}/test": {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
get?: never;
put?: never;
/** Send a ping now and tell how it went */
post: operations["WebhooksController_test"];
delete?: never;
options?: never;
head?: never;
patch?: never;
trace?: never;
};
}
export type webhooks = Record<string, never>;
export interface components {
@@ -2098,6 +2171,61 @@ export interface components {
/** @description Tickets that got something new */
recorded: number;
};
WebhookDeliveryDto: {
/** Format: date-time */
at: string;
/** @example issue.created */
event: string;
/** @description HTTP status */
status: number | null;
ok: boolean;
error: string | null;
};
WebhookDto: {
/** Format: uuid */
id: string;
/** Format: uuid */
projectId: string;
url: string;
events: string[];
active: boolean;
createdBy: components["schemas"]["UserRefDto"];
/** Format: date-time */
createdAt: string;
lastDelivery: components["schemas"]["WebhookDeliveryDto"] | null;
};
CreateWebhookDto: {
/** @example https://chat.example.org/hooks/taskstream */
url: string;
/**
* @description Event names (GET /api/webhook-events), family.* or *
* @example [
* "issue.status_changed",
* "release.*"
* ]
*/
events: string[];
};
WebhookCreatedDto: {
/** Format: uuid */
id: string;
/** @description Signs every delivery. Shown only now. */
secret: string;
};
UpdateWebhookDto: {
/** @example https://chat.example.org/hooks/taskstream */
url?: string;
/**
* @description Event names (GET /api/webhook-events), family.* or *
* @example [
* "issue.status_changed",
* "release.*"
* ]
*/
events?: string[];
/** @description Paused webhooks get nothing */
active?: boolean;
};
};
responses: never;
parameters: never;
@@ -7539,4 +7667,388 @@ export interface operations {
};
};
};
WebhooksController_events: {
parameters: {
query?: never;
header?: never;
path?: never;
cookie?: never;
};
requestBody?: never;
responses: {
200: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": string[];
};
};
};
};
WebhooksController_list: {
parameters: {
query?: never;
header?: never;
path: {
/** @description Project id or key */
project: string;
};
cookie?: never;
};
requestBody?: never;
responses: {
200: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["WebhookDto"][];
};
};
/** @description Invalid input */
400: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Missing or rejected Pireon token */
401: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not a member of the project (or not allowed) */
403: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not found */
404: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
};
};
WebhooksController_create: {
parameters: {
query?: never;
header?: never;
path: {
/** @description Project id or key */
project: string;
};
cookie?: never;
};
requestBody: {
content: {
"application/json": components["schemas"]["CreateWebhookDto"];
};
};
responses: {
201: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["WebhookCreatedDto"];
};
};
/** @description Invalid input */
400: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Missing or rejected Pireon token */
401: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not a member of the project (or not allowed) */
403: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not found */
404: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Someone changed it at the same time: retry */
409: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Business rule (e.g. a transition the workflow forbids) */
422: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
};
};
WebhooksController_delete: {
parameters: {
query?: never;
header?: never;
path: {
webhook: string;
};
cookie?: never;
};
requestBody?: never;
responses: {
204: {
headers: {
[name: string]: unknown;
};
content?: never;
};
/** @description Invalid input */
400: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Missing or rejected Pireon token */
401: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not a member of the project (or not allowed) */
403: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not found */
404: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Someone changed it at the same time: retry */
409: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Business rule (e.g. a transition the workflow forbids) */
422: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
};
};
WebhooksController_update: {
parameters: {
query?: never;
header?: never;
path: {
webhook: string;
};
cookie?: never;
};
requestBody: {
content: {
"application/json": components["schemas"]["UpdateWebhookDto"];
};
};
responses: {
200: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["WebhookDto"];
};
};
/** @description Invalid input */
400: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Missing or rejected Pireon token */
401: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not a member of the project (or not allowed) */
403: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not found */
404: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Someone changed it at the same time: retry */
409: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Business rule (e.g. a transition the workflow forbids) */
422: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
};
};
WebhooksController_test: {
parameters: {
query?: never;
header?: never;
path: {
webhook: string;
};
cookie?: never;
};
requestBody?: never;
responses: {
200: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["WebhookDeliveryDto"];
};
};
/** @description Invalid input */
400: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Missing or rejected Pireon token */
401: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not a member of the project (or not allowed) */
403: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Not found */
404: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Someone changed it at the same time: retry */
409: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
/** @description Business rule (e.g. a transition the workflow forbids) */
422: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": components["schemas"]["ApiErrorDto"];
};
};
};
};
}