feat: outgoing webhooks

Owners and admins can point a project at other systems: a signed JSON POST (HMAC-SHA256 of the body) when tickets, comments, releases or sprints change, filtered by event or family. Deliveries are retried a couple of times, the last one is shown, and a ping can be sent from the settings. Private addresses are refused unless WEBHOOKS_ALLOW_PRIVATE is set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 15:36:19 +02:00
parent 046d77c813
commit d43fc620e9
37 changed files with 3660 additions and 28 deletions
--- a/libs/api/tracker/application/src/index.ts
+++ b/libs/api/tracker/application/src/index.ts
@@ -12,6 +12,9 @@ export * from './lib/notifications';
 export * from './lib/saved-filters.service';
 export * from './lib/sprints.service';
 export * from './lib/git.service';
+export * from './lib/webhooks.service';
+export * from './lib/webhooks/webhooks';
+export * from './lib/webhooks/webhook-events';
 export * from './lib/git/git';
 export * from './lib/git/git-payloads';
 export * from './lib/saved-filters/saved-filters';
--- a/libs/api/tracker/application/src/lib/ports/index.ts
+++ b/libs/api/tracker/application/src/lib/ports/index.ts
@@ -24,3 +24,4 @@ export * from './saved-filters.repository';
 export * from './find-sprints.repository';
 export * from './upsert-materialized-sprint.repository';
 export * from './git-integrations.repository';
+export * from './outgoing-webhooks.repository';
--- a/libs/api/tracker/application/src/lib/ports/outgoing-webhooks.repository.ts
+++ b/libs/api/tracker/application/src/lib/ports/outgoing-webhooks.repository.ts
@@ -0,0 +1,48 @@
+import { UserRefReadModel } from '@task-stream/api/tracker/domain';
+
+export interface WebhookDelivery {
+  at: string;
+  event: string;
+  /** HTTP status, null when it never answered. */
+  status: number | null;
+  ok: boolean;
+  error: string | null;
+}
+
+/** Where a project tells other systems what happened in it. */
+export interface OutgoingWebhook {
+  id: string;
+  projectId: string;
+  url: string;
+  /** Signs every delivery (HMAC-SHA256); shown once, when created. */
+  secret: string;
+  /** Event names, `issue.*` or `*`. */
+  events: string[];
+  active: boolean;
+  createdBy: UserRefReadModel;
+  createdAt: string;
+  lastDelivery: WebhookDelivery | null;
+}
+
+/** Configuration, not history: kept outside the event store. */
+export abstract class OutgoingWebhooksRepository {
+  abstract findByProject(projectId: string): Promise<OutgoingWebhook[]>;
+  abstract findActive(projectId: string): Promise<OutgoingWebhook[]>;
+  abstract findById(id: string): Promise<OutgoingWebhook | null>;
+  abstract insert(webhook: OutgoingWebhook): Promise<void>;
+  abstract update(
+    id: string,
+    changes: Partial<Pick<OutgoingWebhook, 'url' | 'events' | 'active'>>,
+  ): Promise<void>;
+  abstract delete(id: string): Promise<void>;
+  abstract recordDelivery(id: string, delivery: WebhookDelivery): Promise<void>;
+}
+
+/** Sends one delivery. Throws when the receiver cannot be reached. */
+export abstract class WebhookSender {
+  abstract send(request: {
+    url: string;
+    body: string;
+    headers: Record<string, string>;
+  }): Promise<{ status: number }>;
+}
--- a/libs/api/tracker/application/src/lib/tracker-application.module.ts
+++ b/libs/api/tracker/application/src/lib/tracker-application.module.ts
@@ -34,6 +34,8 @@ import { SavedFiltersService } from './saved-filters.service';
 import { SprintsService } from './sprints.service';
 import { GitService } from './git.service';
 import { GIT_HANDLERS } from './git/git';
+import { WebhooksService } from './webhooks.service';
+import { WEBHOOK_HANDLERS } from './webhooks/webhooks';

 /** Notifications: derived from events, kept and dismissed per person. */
 const NOTIFICATIONS = [
@@ -56,6 +58,7 @@ const SERVICES = [
  SavedFiltersService,
  SprintsService,
  GitService,
+  WebhooksService,
 ];

 /**
@@ -79,6 +82,7 @@ const SERVICES = [
    ...NOTIFICATIONS,
    ...SAVED_FILTERS,
    ...GIT_HANDLERS,
+    ...WEBHOOK_HANDLERS,
  ],
  exports: SERVICES,
 })
--- a/libs/api/tracker/application/src/lib/webhooks.service.ts
+++ b/libs/api/tracker/application/src/lib/webhooks.service.ts
@@ -0,0 +1,62 @@
+import { Injectable } from '@nestjs/common';
+import { CommandBus, QueryBus } from '@nestjs/cqrs';
+import { WebhookDelivery } from './ports/outgoing-webhooks.repository';
+import { WEBHOOK_EVENT_NAMES } from './webhooks/webhook-events';
+import {
+  CreateWebhookCommand,
+  DeleteWebhookCommand,
+  GetWebhooksQuery,
+  TestWebhookCommand,
+  UpdateWebhookCommand,
+  WebhookView,
+} from './webhooks/webhooks';
+
+/** The project's outgoing webhooks (owners and admins). */
+@Injectable()
+export class WebhooksService {
+  constructor(
+    private readonly commandBus: CommandBus,
+    private readonly queryBus: QueryBus,
+  ) {}
+
+  /** Names other systems can subscribe to (plus `family.*` and `*`). */
+  events(): string[] {
+    return WEBHOOK_EVENT_NAMES;
+  }
+
+  list(viewerId: string, projectId: string): Promise<WebhookView[]> {
+    return this.queryBus.execute(new GetWebhooksQuery(viewerId, projectId));
+  }
+
+  /** The secret comes back only here. */
+  create(
+    actorId: string,
+    projectId: string,
+    url: string,
+    events: string[],
+  ): Promise<{ id: string; secret: string }> {
+    return this.commandBus.execute(
+      new CreateWebhookCommand(actorId, projectId, url, events),
+    );
+  }
+
+  update(
+    actorId: string,
+    webhookId: string,
+    changes: { url?: string; events?: string[]; active?: boolean },
+  ): Promise<WebhookView> {
+    return this.commandBus.execute(
+      new UpdateWebhookCommand(actorId, webhookId, changes),
+    );
+  }
+
+  delete(actorId: string, webhookId: string): Promise<void> {
+    return this.commandBus.execute(
+      new DeleteWebhookCommand(actorId, webhookId),
+    );
+  }
+
+  test(actorId: string, webhookId: string): Promise<WebhookDelivery> {
+    return this.commandBus.execute(new TestWebhookCommand(actorId, webhookId));
+  }
+}
--- a/libs/api/tracker/application/src/lib/webhooks/webhook-events.ts
+++ b/libs/api/tracker/application/src/lib/webhooks/webhook-events.ts
@@ -0,0 +1,73 @@
+import {
+  CommentAddedEvent,
+  CommentDeletedEvent,
+  CommentEditedEvent,
+  IssueAssignedEvent,
+  IssueCreatedEvent,
+  IssueDeletedEvent,
+  IssueDevLinkRecordedEvent,
+  IssueReleaseChangedEvent,
+  IssueSprintChangedEvent,
+  IssueStatusChangedEvent,
+  IssueUpdatedEvent,
+  ReleaseArchivedEvent,
+  ReleaseCreatedEvent,
+  ReleaseShippedEvent,
+  SprintClosedEvent,
+  SprintStartedEvent,
+  TrackerEvent,
+} from '@task-stream/api/tracker/domain';
+import { Type } from '@nestjs/common';
+
+/** What other systems can subscribe to, by the event that causes it. */
+export const WEBHOOK_EVENTS: [Type<TrackerEvent>, string][] = [
+  [IssueCreatedEvent, 'issue.created'],
+  [IssueUpdatedEvent, 'issue.updated'],
+  [IssueStatusChangedEvent, 'issue.status_changed'],
+  [IssueAssignedEvent, 'issue.assigned'],
+  [IssueSprintChangedEvent, 'issue.sprint_changed'],
+  [IssueReleaseChangedEvent, 'issue.release_changed'],
+  [IssueDevLinkRecordedEvent, 'issue.dev_link'],
+  [IssueDeletedEvent, 'issue.deleted'],
+  [CommentAddedEvent, 'comment.added'],
+  [CommentEditedEvent, 'comment.edited'],
+  [CommentDeletedEvent, 'comment.deleted'],
+  [ReleaseCreatedEvent, 'release.created'],
+  [ReleaseShippedEvent, 'release.shipped'],
+  [ReleaseArchivedEvent, 'release.archived'],
+  [SprintStartedEvent, 'sprint.started'],
+  [SprintClosedEvent, 'sprint.closed'],
+];
+
+export const WEBHOOK_EVENT_NAMES = WEBHOOK_EVENTS.map(([, name]) => name);
+
+export function webhookEventOf(event: TrackerEvent): string | null {
+  return WEBHOOK_EVENTS.find(([type]) => event instanceof type)?.[1] ?? null;
+}
+
+/** `*`, an exact name, or a family (`issue.*`). */
+export function subscribes(events: string[], name: string): boolean {
+  return events.some(
+    (e) =>
+      e === '*' ||
+      e === name ||
+      (e.endsWith('.*') && name.startsWith(e.slice(0, -1))),
+  );
+}
+
+/** Keeps known names and families, once each. */
+export function normalizeWebhookEvents(events: string[]): string[] {
+  const families = new Set(
+    WEBHOOK_EVENT_NAMES.map((n) => `${n.split('.')[0]}.*`),
+  );
+  return [
+    ...new Set(
+      events
+        .map((e) => e.trim())
+        .filter(
+          (e) =>
+            e === '*' || families.has(e) || WEBHOOK_EVENT_NAMES.includes(e),
+        ),
+    ),
+  ];
+}
--- a/libs/api/tracker/application/src/lib/webhooks/webhooks.spec.ts
+++ b/libs/api/tracker/application/src/lib/webhooks/webhooks.spec.ts
@@ -0,0 +1,90 @@
+import { createHmac } from 'node:crypto';
+import {
+  OutgoingWebhook,
+  OutgoingWebhooksRepository,
+  WebhookDelivery,
+  WebhookSender,
+} from '../ports/outgoing-webhooks.repository';
+import { normalizeWebhookEvents, subscribes } from './webhook-events';
+import { WebhookDispatcher } from './webhooks';
+
+const webhook: OutgoingWebhook = {
+  id: 'w1',
+  projectId: 'p1',
+  url: 'https://example.org/hook',
+  secret: 's3cret',
+  events: ['issue.*'],
+  active: true,
+  createdBy: { id: 'u', name: 'U' },
+  createdAt: '',
+  lastDelivery: null,
+};
+
+function doubles(statuses: (number | Error)[]) {
+  const recorded: WebhookDelivery[] = [];
+  const sent: { body: string; headers: Record<string, string> }[] = [];
+  const repo = {
+    recordDelivery: async (_id: string, d: WebhookDelivery) => {
+      recorded.push(d);
+    },
+  } as unknown as OutgoingWebhooksRepository;
+  const sender: WebhookSender = {
+    send: async (request) => {
+      sent.push(request);
+      const next = statuses.shift() ?? 200;
+      if (next instanceof Error) throw next;
+      return { status: next };
+    },
+  };
+  return { repo, sender, recorded, sent };
+}
+
+describe('outgoing webhooks', () => {
+  it('subscribes to names, families and everything', () => {
+    expect(subscribes(['issue.*'], 'issue.created')).toBe(true);
+    expect(subscribes(['issue.*'], 'comment.added')).toBe(false);
+    expect(subscribes(['*'], 'sprint.closed')).toBe(true);
+    expect(
+      normalizeWebhookEvents(['issue.*', 'nope', ' sprint.closed ', 'issue.*']),
+    ).toEqual(['issue.*', 'sprint.closed']);
+  });
+
+  it('signs the body and retries until it gets through', async () => {
+    const { repo, sender, recorded, sent } = doubles([
+      new Error('ECONNRESET'),
+      503,
+      204,
+    ]);
+    const delivery = await new WebhookDispatcher(
+      repo,
+      sender,
+      [0, 0, 0],
+    ).deliver(webhook, 'issue.created', { data: { title: 'x' } });
+    expect(sent).toHaveLength(3);
+    const { body, headers } = sent[0];
+    expect(headers['x-taskstream-signature']).toBe(
+      `sha256=${createHmac('sha256', 's3cret').update(body).digest('hex')}`,
+    );
+    expect(JSON.parse(body)).toMatchObject({
+      event: 'issue.created',
+      data: { title: 'x' },
+    });
+    expect(delivery).toMatchObject({ ok: true, status: 204 });
+    expect(recorded).toEqual([delivery]);
+  });
+
+  it('gives up at once on a 4xx', async () => {
+    const { repo, sender, sent } = doubles([410]);
+    const delivery = await new WebhookDispatcher(
+      repo,
+      sender,
+      [0, 0, 0],
+    ).deliver(webhook, 'issue.created', {});
+    expect(sent).toHaveLength(1);
+    expect(delivery).toMatchObject({
+      ok: false,
+      status: 410,
+      error: 'HTTP 410',
+    });
+  });
+});
--- a/libs/api/tracker/application/src/lib/webhooks/webhooks.ts
+++ b/libs/api/tracker/application/src/lib/webhooks/webhooks.ts
@@ -0,0 +1,411 @@
+import { createHmac, randomBytes, randomUUID } from 'node:crypto';
+import { Logger } from '@nestjs/common';
+import {
+  Command,
+  CommandHandler,
+  EventsHandler,
+  ICommandHandler,
+  IEventHandler,
+  IQueryHandler,
+  Query,
+  QueryHandler,
+} from '@nestjs/cqrs';
+import {
+  BusinessRuleError,
+  NotFoundError,
+  assertThat,
+} from '@task-stream/api/shared/domain';
+import { TrackerEvent } from '@task-stream/api/tracker/domain';
+import { WriteAccess } from '../commands/write-access';
+import { FindIssuesRepository } from '../ports/find-issues.repository';
+import { FindProjectsRepository } from '../ports/find-projects.repository';
+import {
+  OutgoingWebhook,
+  OutgoingWebhooksRepository,
+  WebhookDelivery,
+  WebhookSender,
+} from '../ports/outgoing-webhooks.repository';
+import { UserDirectory } from '../ports/user-directory';
+import {
+  WEBHOOK_EVENTS,
+  normalizeWebhookEvents,
+  subscribes,
+  webhookEventOf,
+} from './webhook-events';
+
+/** A project keeps at most this many webhooks. */
+export const MAX_WEBHOOKS = 20;
+/** Waits between attempts: right away, after 2 s, after 10 s. */
+export const RETRY_DELAYS_MS = [0, 2_000, 10_000];
+
+/** The webhook as listed: the secret is only ever shown when created. */
+export type WebhookView = Omit<OutgoingWebhook, 'secret'>;
+const view = ({ secret: _secret, ...rest }: OutgoingWebhook): WebhookView =>
+  rest;
+
+function assertUrl(url: string): string {
+  const next = url.trim();
+  let parsed: URL | null = null;
+  try {
+    parsed = new URL(next);
+  } catch {
+    parsed = null;
+  }
+  assertThat(
+    !!parsed && ['http:', 'https:'].includes(parsed.protocol),
+    'A webhook needs an http(s) URL',
+  );
+  return next;
+}
+
+export class CreateWebhookCommand extends Command<{
+  id: string;
+  secret: string;
+}> {
+  constructor(
+    public readonly actorId: string,
+    public readonly projectId: string,
+    public readonly url: string,
+    public readonly events: string[],
+  ) {
+    super();
+  }
+}
+
+export class UpdateWebhookCommand extends Command<WebhookView> {
+  constructor(
+    public readonly actorId: string,
+    public readonly webhookId: string,
+    public readonly changes: {
+      url?: string;
+      events?: string[];
+      active?: boolean;
+    },
+  ) {
+    super();
+  }
+}
+
+export class DeleteWebhookCommand extends Command<void> {
+  constructor(
+    public readonly actorId: string,
+    public readonly webhookId: string,
+  ) {
+    super();
+  }
+}
+
+/** Sends a `ping` now and tells how it went. */
+export class TestWebhookCommand extends Command<WebhookDelivery> {
+  constructor(
+    public readonly actorId: string,
+    public readonly webhookId: string,
+  ) {
+    super();
+  }
+}
+
+export class GetWebhooksQuery extends Query<WebhookView[]> {
+  constructor(
+    public readonly viewerId: string,
+    public readonly projectId: string,
+  ) {
+    super();
+  }
+}
+
+/** Signs and sends deliveries, retrying a couple of times, and records the outcome. */
+export class WebhookDispatcher {
+  private readonly logger = new Logger(WebhookDispatcher.name);
+
+  constructor(
+    private readonly webhooks: OutgoingWebhooksRepository,
+    private readonly sender: WebhookSender,
+    private readonly delays: number[] = RETRY_DELAYS_MS,
+  ) {}
+
+  async deliver(
+    webhook: OutgoingWebhook,
+    event: string,
+    payload: Record<string, unknown>,
+  ): Promise<WebhookDelivery> {
+    const deliveryId = randomUUID();
+    const body = JSON.stringify({ event, deliveryId, ...payload });
+    const signature = createHmac('sha256', webhook.secret)
+      .update(body)
+      .digest('hex');
+    let delivery: WebhookDelivery = {
+      at: new Date().toISOString(),
+      event,
+      status: null,
+      ok: false,
+      error: null,
+    };
+    for (const delay of this.delays) {
+      if (delay) await new Promise((resolve) => setTimeout(resolve, delay));
+      try {
+        const { status } = await this.sender.send({
+          url: webhook.url,
+          body,
+          headers: {
+            'content-type': 'application/json',
+            'user-agent': 'TaskStream-Webhooks',
+            'x-taskstream-event': event,
+            'x-taskstream-delivery': deliveryId,
+            'x-taskstream-signature': `sha256=${signature}`,
+          },
+        });
+        delivery = {
+          ...delivery,
+          at: new Date().toISOString(),
+          status,
+          ok: status < 300,
+          error: status < 300 ? null : `HTTP ${status}`,
+        };
+        // A 4xx will not get better by retrying.
+        if (delivery.ok || (status >= 400 && status < 500)) break;
+      } catch (error) {
+        delivery = {
+          ...delivery,
+          at: new Date().toISOString(),
+          status: null,
+          ok: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
+    }
+    if (!delivery.ok)
+      this.logger.warn(
+        `Webhook ${webhook.id} (${event}) failed: ${delivery.error}`,
+      );
+    await this.webhooks.recordDelivery(webhook.id, delivery);
+    return delivery;
+  }
+}
+
+/** Whoever manages the project of a webhook. */
+async function managedWebhook(
+  webhooks: OutgoingWebhooksRepository,
+  access: WriteAccess,
+  webhookId: string,
+  actorId: string,
+): Promise<OutgoingWebhook> {
+  const webhook = await webhooks.findById(webhookId);
+  if (!webhook) throw new NotFoundError('Webhook', webhookId);
+  (await access.project(webhook.projectId)).assertCanManage(actorId);
+  return webhook;
+}
+
+@CommandHandler(CreateWebhookCommand)
+export class CreateWebhookCommandHandler
+  implements ICommandHandler<CreateWebhookCommand>
+{
+  constructor(
+    private readonly webhooks: OutgoingWebhooksRepository,
+    private readonly access: WriteAccess,
+    private readonly users: UserDirectory,
+  ) {}
+
+  async execute(command: CreateWebhookCommand) {
+    (await this.access.project(command.projectId)).assertCanManage(
+      command.actorId,
+    );
+    const events = normalizeWebhookEvents(command.events);
+    assertThat(events.length > 0, 'Pick at least one event');
+    if (
+      (await this.webhooks.findByProject(command.projectId)).length >=
+      MAX_WEBHOOKS
+    )
+      throw new BusinessRuleError(
+        `A project keeps at most ${MAX_WEBHOOKS} webhooks`,
+      );
+    const users = await this.users.refs([command.actorId]);
+    const webhook: OutgoingWebhook = {
+      id: randomUUID(),
+      projectId: command.projectId,
+      url: assertUrl(command.url),
+      secret: randomBytes(24).toString('hex'),
+      events,
+      active: true,
+      createdBy: users.of(command.actorId),
+      createdAt: new Date().toISOString(),
+      lastDelivery: null,
+    };
+    await this.webhooks.insert(webhook);
+    return { id: webhook.id, secret: webhook.secret };
+  }
+}
+
+@CommandHandler(UpdateWebhookCommand)
+export class UpdateWebhookCommandHandler
+  implements ICommandHandler<UpdateWebhookCommand>
+{
+  constructor(
+    private readonly webhooks: OutgoingWebhooksRepository,
+    private readonly access: WriteAccess,
+  ) {}
+
+  async execute(command: UpdateWebhookCommand): Promise<WebhookView> {
+    const webhook = await managedWebhook(
+      this.webhooks,
+      this.access,
+      command.webhookId,
+      command.actorId,
+    );
+    const changes: { url?: string; events?: string[]; active?: boolean } = {};
+    if (command.changes.url !== undefined)
+      changes.url = assertUrl(command.changes.url);
+    if (command.changes.events !== undefined) {
+      changes.events = normalizeWebhookEvents(command.changes.events);
+      assertThat(changes.events.length > 0, 'Pick at least one event');
+    }
+    if (command.changes.active !== undefined)
+      changes.active = command.changes.active;
+    await this.webhooks.update(webhook.id, changes);
+    return view({ ...webhook, ...changes });
+  }
+}
+
+@CommandHandler(DeleteWebhookCommand)
+export class DeleteWebhookCommandHandler
+  implements ICommandHandler<DeleteWebhookCommand>
+{
+  constructor(
+    private readonly webhooks: OutgoingWebhooksRepository,
+    private readonly access: WriteAccess,
+  ) {}
+
+  async execute(command: DeleteWebhookCommand): Promise<void> {
+    const webhook = await managedWebhook(
+      this.webhooks,
+      this.access,
+      command.webhookId,
+      command.actorId,
+    );
+    await this.webhooks.delete(webhook.id);
+  }
+}
+
+@CommandHandler(TestWebhookCommand)
+export class TestWebhookCommandHandler
+  implements ICommandHandler<TestWebhookCommand>
+{
+  constructor(
+    private readonly webhooks: OutgoingWebhooksRepository,
+    private readonly access: WriteAccess,
+    private readonly sender: WebhookSender,
+  ) {}
+
+  async execute(command: TestWebhookCommand): Promise<WebhookDelivery> {
+    const webhook = await managedWebhook(
+      this.webhooks,
+      this.access,
+      command.webhookId,
+      command.actorId,
+    );
+    // One attempt: someone is waiting for the answer.
+    return new WebhookDispatcher(this.webhooks, this.sender, [0]).deliver(
+      webhook,
+      'ping',
+      {
+        occurredAt: new Date().toISOString(),
+        projectId: webhook.projectId,
+        actorId: command.actorId,
+        data: { message: 'Hola desde TaskStream' },
+      },
+    );
+  }
+}
+
+@QueryHandler(GetWebhooksQuery)
+export class GetWebhooksQueryHandler
+  implements IQueryHandler<GetWebhooksQuery, WebhookView[]>
+{
+  constructor(
+    private readonly webhooks: OutgoingWebhooksRepository,
+    private readonly access: WriteAccess,
+  ) {}
+
+  async execute(query: GetWebhooksQuery): Promise<WebhookView[]> {
+    (await this.access.project(query.projectId)).assertCanManage(
+      query.viewerId,
+    );
+    return (await this.webhooks.findByProject(query.projectId)).map(view);
+  }
+}
+
+/** The event's own fields: what happened, without the envelope. */
+function dataOf(event: TrackerEvent): Record<string, unknown> {
+  const {
+    actorId: _actor,
+    aggregateId: _aggregate,
+    projectId: _project,
+    occurredAt: _at,
+    aggregateVersion: _version,
+    ...data
+  } = event as unknown as Record<string, unknown>;
+  return data;
+}
+
+/**
+ * Tells the project's webhooks about what happened. Deliveries go out in the
+ * background: a slow receiver never holds the events bridge.
+ */
+@EventsHandler(...WEBHOOK_EVENTS.map(([type]) => type))
+export class OutgoingWebhooksEventHandler
+  implements IEventHandler<TrackerEvent>
+{
+  private readonly dispatcher: WebhookDispatcher;
+
+  constructor(
+    private readonly webhooks: OutgoingWebhooksRepository,
+    sender: WebhookSender,
+    private readonly findProjects: FindProjectsRepository,
+    private readonly findIssues: FindIssuesRepository,
+  ) {
+    this.dispatcher = new WebhookDispatcher(webhooks, sender);
+  }
+
+  async handle(event: TrackerEvent) {
+    const name = webhookEventOf(event);
+    if (!name) return;
+    const targets = (await this.webhooks.findActive(event.projectId)).filter(
+      (w) => subscribes(w.events, name),
+    );
+    if (!targets.length) return;
+    const project = await this.findProjects.findById(event.projectId);
+    const issueId = event.constructor.name.startsWith('Issue')
+      ? event.aggregateId
+      : ((event as { issueId?: string; comment?: { issueId: string } })
+          .issueId ??
+        (event as { comment?: { issueId: string } }).comment?.issueId ??
+        null);
+    const issue = issueId ? await this.findIssues.findById(issueId) : null;
+    const payload = {
+      occurredAt: event.occurredAt,
+      actorId: event.actorId,
+      project: project
+        ? { id: project.id, key: project.key }
+        : { id: event.projectId },
+      aggregateId: event.aggregateId,
+      version: event.aggregateVersion ?? null,
+      ...(issue
+        ? { issue: { id: issue.id, key: issue.key, title: issue.title } }
+        : {}),
+      data: dataOf(event),
+    };
+    for (const webhook of targets)
+      void this.dispatcher
+        .deliver(webhook, name, payload)
+        .catch(() => undefined);
+  }
+}
+
+export const WEBHOOK_HANDLERS = [
+  CreateWebhookCommandHandler,
+  UpdateWebhookCommandHandler,
+  DeleteWebhookCommandHandler,
+  TestWebhookCommandHandler,
+  GetWebhooksQueryHandler,
+  OutgoingWebhooksEventHandler,
+];
--- a/libs/api/tracker/infrastructure/src/lib/mongo/outgoing-webhooks.repository.ts
+++ b/libs/api/tracker/infrastructure/src/lib/mongo/outgoing-webhooks.repository.ts
@@ -0,0 +1,62 @@
+import { Injectable } from '@nestjs/common';
+import { InjectModel } from '@nestjs/mongoose';
+import {
+  OutgoingWebhook,
+  OutgoingWebhooksRepository,
+  WebhookDelivery,
+} from '@task-stream/api/tracker/application';
+import { Model } from 'mongoose';
+import { OutgoingWebhookDoc, ReadModels, fromDoc } from './read-model.schemas';
+
+@Injectable()
+export class MongoOutgoingWebhooksRepository extends OutgoingWebhooksRepository {
+  constructor(
+    @InjectModel(ReadModels.OutgoingWebhook)
+    private readonly webhooks: Model<OutgoingWebhookDoc>,
+  ) {
+    super();
+  }
+
+  async findByProject(projectId: string): Promise<OutgoingWebhook[]> {
+    const docs = await this.webhooks
+      .find({ projectId })
+      .sort({ createdAt: 1 })
+      .lean<OutgoingWebhookDoc[]>();
+    return docs.map((doc) => fromDoc(doc) as OutgoingWebhook);
+  }
+
+  async findActive(projectId: string): Promise<OutgoingWebhook[]> {
+    const docs = await this.webhooks
+      .find({ projectId, active: true })
+      .lean<OutgoingWebhookDoc[]>();
+    return docs.map((doc) => fromDoc(doc) as OutgoingWebhook);
+  }
+
+  async findById(id: string): Promise<OutgoingWebhook | null> {
+    const doc = await this.webhooks.findById(id).lean<OutgoingWebhookDoc>();
+    return doc ? (fromDoc(doc) as OutgoingWebhook) : null;
+  }
+
+  async insert({ id, ...rest }: OutgoingWebhook): Promise<void> {
+    await this.webhooks.create({ _id: id, ...rest });
+  }
+
+  async update(
+    id: string,
+    changes: Partial<Pick<OutgoingWebhook, 'url' | 'events' | 'active'>>,
+  ): Promise<void> {
+    if (Object.keys(changes).length)
+      await this.webhooks.updateOne({ _id: id }, { $set: changes });
+  }
+
+  async delete(id: string): Promise<void> {
+    await this.webhooks.deleteOne({ _id: id });
+  }
+
+  async recordDelivery(id: string, delivery: WebhookDelivery): Promise<void> {
+    await this.webhooks.updateOne(
+      { _id: id },
+      { $set: { lastDelivery: delivery } },
+    );
+  }
+}
--- a/libs/api/tracker/infrastructure/src/lib/mongo/read-model.schemas.ts
+++ b/libs/api/tracker/infrastructure/src/lib/mongo/read-model.schemas.ts
@@ -1,3 +1,4 @@
+import { OutgoingWebhook } from '@task-stream/api/tracker/application';
 import {
  ActivityReadModel,
  CommentReadModel,
@@ -30,6 +31,7 @@ export type ActivityDoc = Doc<ActivityReadModel>;
 export type TimelineDoc = Doc<IssueTimelineEntry>;
 export type NotificationDoc = Doc<NotificationReadModel>;
 export type SavedFilterDoc = Doc<SavedFilterReadModel>;
+export type OutgoingWebhookDoc = Omit<OutgoingWebhook, 'id'> & { _id: string };
 export interface GitIntegrationDoc {
  _id: string;
  secret: string;
@@ -52,6 +54,7 @@ export const ReadModels = {
  SavedFilter: 'SavedFilter',
  Sprint: 'SprintReadModel',
  GitIntegration: 'GitIntegration',
+  OutgoingWebhook: 'OutgoingWebhook',
 } as const;

 const userRef = { _id: false, id: String, name: String };
@@ -203,6 +206,18 @@ export const GitIntegrationSchema = new Schema<GitIntegrationDoc>(
  { ...loose, collection: 'git_integrations' },
 );

+export const OutgoingWebhookSchema = new Schema<OutgoingWebhookDoc>(
+  {
+    _id: String,
+    projectId: { type: String, index: true },
+    active: Boolean,
+    events: [String],
+    createdBy: userRef,
+    createdAt: String,
+  },
+  { ...loose, collection: 'outgoing_webhooks' },
+);
+
 export const READ_MODEL_SCHEMAS = [
  { name: ReadModels.Project, schema: ProjectSchema },
  { name: ReadModels.Issue, schema: IssueSchema },
@@ -210,6 +225,7 @@ export const READ_MODEL_SCHEMAS = [
  { name: ReadModels.Release, schema: ReleaseSchema },
  { name: ReadModels.Sprint, schema: SprintSchema },
  { name: ReadModels.GitIntegration, schema: GitIntegrationSchema },
+  { name: ReadModels.OutgoingWebhook, schema: OutgoingWebhookSchema },
  { name: ReadModels.Activity, schema: ActivitySchema },
  { name: ReadModels.Timeline, schema: TimelineSchema },
  { name: ReadModels.Notification, schema: NotificationSchema },
--- a/libs/api/tracker/infrastructure/src/lib/mongo/upsert-materialized.repositories.ts
+++ b/libs/api/tracker/infrastructure/src/lib/mongo/upsert-materialized.repositories.ts
@@ -33,6 +33,7 @@ import {
  ReleaseDoc,
  SavedFilterDoc,
  GitIntegrationDoc,
+  OutgoingWebhookDoc,
  TimelineDoc,
 } from './read-model.schemas';
 import { upsertIfNewer } from './upsert-if-newer';
@@ -52,6 +53,8 @@ export class MongoUpsertMaterializedProjectRepository extends UpsertMaterialized
    private readonly savedFilters: Model<SavedFilterDoc>,
    @InjectModel(ReadModels.GitIntegration)
    private readonly gitIntegrations: Model<GitIntegrationDoc>,
+    @InjectModel(ReadModels.OutgoingWebhook)
+    private readonly outgoingWebhooks: Model<OutgoingWebhookDoc>,
  ) {
    super();
  }
@@ -64,6 +67,7 @@ export class MongoUpsertMaterializedProjectRepository extends UpsertMaterialized
      // Views of the board of a project that is gone.
      this.savedFilters.deleteMany({ projectId }),
      this.gitIntegrations.deleteOne({ _id: projectId }),
+      this.outgoingWebhooks.deleteMany({ projectId }),
    ]);
  }

--- a/libs/api/tracker/infrastructure/src/lib/tracker-infrastructure.module.ts
+++ b/libs/api/tracker/infrastructure/src/lib/tracker-infrastructure.module.ts
@@ -9,6 +9,8 @@ import {
  NotificationsRepository,
  SavedFiltersRepository,
  GitIntegrationsRepository,
+  OutgoingWebhooksRepository,
+  WebhookSender,
  FindActivityRepository,
  FindCommentsRepository,
  FindIssuesRepository,
@@ -62,6 +64,8 @@ import { RedisChangeFeed } from './realtime/redis-change-feed';
 import { MongoNotificationsRepository } from './mongo/notifications.repository';
 import { MongoSavedFiltersRepository } from './mongo/saved-filters.repository';
 import { MongoGitIntegrationsRepository } from './mongo/git-integrations.repository';
+import { MongoOutgoingWebhooksRepository } from './mongo/outgoing-webhooks.repository';
+import { HttpWebhookSender } from './webhooks/http-webhook.sender';
 import {
  MongoFindSprintsRepository,
  MongoUpsertMaterializedSprintRepository,
@@ -127,6 +131,11 @@ const PORTS = [
    provide: GitIntegrationsRepository,
    useClass: MongoGitIntegrationsRepository,
  },
+  {
+    provide: OutgoingWebhooksRepository,
+    useClass: MongoOutgoingWebhooksRepository,
+  },
+  { provide: WebhookSender, useClass: HttpWebhookSender },
  { provide: NotificationMailer, useClass: SmtpNotificationMailer },
  // Realtime → Redis pub/sub
  { provide: ChangeFeed, useClass: RedisChangeFeed },
--- a/libs/api/tracker/infrastructure/src/lib/webhooks/http-webhook.sender.spec.ts
+++ b/libs/api/tracker/infrastructure/src/lib/webhooks/http-webhook.sender.spec.ts
@@ -0,0 +1,19 @@
+import { isPrivateAddress } from './http-webhook.sender';
+
+describe('webhook sender', () => {
+  it('knows private and loopback addresses', () => {
+    for (const address of [
+      '127.0.0.1',
+      '10.1.2.3',
+      '172.20.0.5',
+      '192.168.1.9',
+      '169.254.169.254',
+      '::1',
+      'fd00::1',
+      '::ffff:127.0.0.1',
+    ])
+      expect(isPrivateAddress(address)).toBe(true);
+    for (const address of ['8.8.8.8', '172.32.0.1', '2a00:1450::1'])
+      expect(isPrivateAddress(address)).toBe(false);
+  });
+});
--- a/libs/api/tracker/infrastructure/src/lib/webhooks/http-webhook.sender.ts
+++ b/libs/api/tracker/infrastructure/src/lib/webhooks/http-webhook.sender.ts
@@ -0,0 +1,73 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { WebhookSender } from '@task-stream/api/tracker/application';
+
+const TIMEOUT_MS = 5_000;
+
+/** Loopback, private, link-local and unique-local addresses. */
+export function isPrivateAddress(address: string): boolean {
+  if (isIP(address) === 4) {
+    const [a, b] = address.split('.').map(Number);
+    return (
+      a === 10 ||
+      a === 127 ||
+      a === 0 ||
+      (a === 169 && b === 254) ||
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 168) ||
+      (a === 100 && b >= 64 && b <= 127)
+    );
+  }
+  const v6 = address.toLowerCase();
+  return (
+    v6 === '::1' ||
+    v6 === '::' ||
+    v6.startsWith('fe80:') ||
+    v6.startsWith('fc') ||
+    v6.startsWith('fd') ||
+    (v6.startsWith('::ffff:') && isPrivateAddress(v6.slice(7)))
+  );
+}
+
+/**
+ * Posts deliveries with fetch, 5 s at most. Unless WEBHOOKS_ALLOW_PRIVATE is
+ * true, refuses hosts that resolve to this machine or its private network:
+ * a webhook must not become a way to reach internal services.
+ */
+@Injectable()
+export class HttpWebhookSender extends WebhookSender {
+  private readonly allowPrivate: boolean;
+
+  constructor(config: ConfigService) {
+    super();
+    this.allowPrivate =
+      String(config.get('WEBHOOKS_ALLOW_PRIVATE') ?? '').toLowerCase() ===
+      'true';
+  }
+
+  async send(request: {
+    url: string;
+    body: string;
+    headers: Record<string, string>;
+  }): Promise<{ status: number }> {
+    const url = new URL(request.url);
+    if (!this.allowPrivate) {
+      const host = url.hostname.replace(/^\[|\]$/g, '');
+      const addresses = isIP(host)
+        ? [host]
+        : (await lookup(host, { all: true })).map((a) => a.address);
+      if (addresses.some(isPrivateAddress))
+        throw new Error(`${url.hostname} is a private address`);
+    }
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: request.headers,
+      body: request.body,
+      redirect: 'manual',
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+    return { status: response.status };
+  }
+}
--- a/libs/api/tracker/presenters/src/lib/graphql/inputs.ts
+++ b/libs/api/tracker/presenters/src/lib/graphql/inputs.ts
@@ -275,6 +275,33 @@ export class SaveFilterInput {
  criteria!: SavedFilterCriteriaInput;
 }

+@InputType()
+export class CreateWebhookInput {
+  @Field(() => ID) @IsUUID() projectId!: string;
+  @Field() @IsUrl({ require_tld: false, require_protocol: true }) url!: string;
+  @Field(() => [String], { description: 'Event names, family.* or *' })
+  @IsArray()
+  @ArrayMaxSize(50)
+  @IsString({ each: true })
+  events!: string[];
+}
+
+@InputType()
+export class UpdateWebhookInput {
+  @Field(() => ID) @IsUUID() webhookId!: string;
+  @Field({ nullable: true })
+  @IsOptional()
+  @IsUrl({ require_tld: false, require_protocol: true })
+  url?: string;
+  @Field(() => [String], { nullable: true })
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(50)
+  @IsString({ each: true })
+  events?: string[];
+  @Field({ nullable: true }) @IsOptional() @IsBoolean() active?: boolean;
+}
+
@InputType()
 export class RankIssueInput {
  @Field(() => ID) @IsUUID() issueId!: string;
--- a/libs/api/tracker/presenters/src/lib/graphql/types.ts
+++ b/libs/api/tracker/presenters/src/lib/graphql/types.ts
@@ -170,6 +170,42 @@ export class GitIntegrationGql {
  webhookPath!: string;
 }

+@ObjectType('WebhookDelivery')
+export class WebhookDeliveryGql {
+  @Field() at!: string;
+  @Field() event!: string;
+  @Field(() => Int, { nullable: true, description: 'HTTP status' })
+  status!: number | null;
+  @Field() ok!: boolean;
+  @Field(() => String, { nullable: true }) error!: string | null;
+}
+
+@ObjectType('Webhook', {
+  description:
+    'Where the project tells another system what happened (signed POST, HMAC-SHA256)',
+})
+export class WebhookGql {
+  @Field(() => ID) id!: string;
+  @Field(() => ID) projectId!: string;
+  @Field() url!: string;
+  @Field(() => [String], { description: 'Event names, family.* or *' })
+  events!: string[];
+  @Field() active!: boolean;
+  @Field(() => UserRefGql) createdBy!: UserRefGql;
+  @Field() createdAt!: string;
+  @Field(() => WebhookDeliveryGql, { nullable: true })
+  lastDelivery!: WebhookDeliveryGql | null;
+}
+
+@ObjectType('WebhookCreated')
+export class WebhookCreatedGql {
+  @Field(() => ID) id!: string;
+  @Field({
+    description: 'Signs every delivery. Shown only now: keep it.',
+  })
+  secret!: string;
+}
+
@ObjectType('IssueParent', { description: 'The ticket another one hangs from' })
 export class IssueParentGql {
  @Field(() => ID) id!: string;
--- a/libs/api/tracker/presenters/src/lib/graphql/webhook.resolver.ts
+++ b/libs/api/tracker/presenters/src/lib/graphql/webhook.resolver.ts
@@ -0,0 +1,72 @@
+import { Args, ID, Mutation, Query, Resolver } from '@nestjs/graphql';
+import { User } from '@task-stream/api/identity/domain';
+import { CurrentUser } from '@task-stream/api/identity/presenters';
+import { WebhooksService } from '@task-stream/api/tracker/application';
+import { CreateWebhookInput, UpdateWebhookInput } from './inputs';
+import { WebhookCreatedGql, WebhookDeliveryGql, WebhookGql } from './types';
+
+/** Outgoing webhooks of a project (owners and admins). */
+@Resolver(() => WebhookGql)
+export class WebhookResolver {
+  constructor(private readonly webhooksService: WebhooksService) {}
+
+  @Query(() => [WebhookGql])
+  webhooks(
+    @CurrentUser() me: User,
+    @Args('projectId', { type: () => ID }) projectId: string,
+  ) {
+    return this.webhooksService.list(me.id, projectId);
+  }
+
+  @Query(() => [String], {
+    description: 'Event names a webhook can subscribe to (also family.* and *)',
+  })
+  webhookEvents() {
+    return this.webhooksService.events();
+  }
+
+  @Mutation(() => WebhookCreatedGql)
+  createWebhook(
+    @CurrentUser() me: User,
+    @Args('input') input: CreateWebhookInput,
+  ) {
+    return this.webhooksService.create(
+      me.id,
+      input.projectId,
+      input.url,
+      input.events,
+    );
+  }
+
+  @Mutation(() => WebhookGql)
+  updateWebhook(
+    @CurrentUser() me: User,
+    @Args('input') input: UpdateWebhookInput,
+  ) {
+    const { webhookId, url, events, active } = input;
+    return this.webhooksService.update(me.id, webhookId, {
+      ...(url != null && { url }),
+      ...(events != null && { events }),
+      ...(active != null && { active }),
+    });
+  }
+
+  @Mutation(() => Boolean)
+  async deleteWebhook(
+    @CurrentUser() me: User,
+    @Args('webhookId', { type: () => ID }) webhookId: string,
+  ) {
+    await this.webhooksService.delete(me.id, webhookId);
+    return true;
+  }
+
+  @Mutation(() => WebhookDeliveryGql, {
+    description: 'Send a ping now and tell how it went',
+  })
+  testWebhook(
+    @CurrentUser() me: User,
+    @Args('webhookId', { type: () => ID }) webhookId: string,
+  ) {
+    return this.webhooksService.test(me.id, webhookId);
+  }
+}
--- a/libs/api/tracker/presenters/src/lib/http/dto/requests.dto.ts
+++ b/libs/api/tracker/presenters/src/lib/http/dto/requests.dto.ts
@@ -731,6 +731,29 @@ export class SaveFilterDto {
  criteria!: SavedFilterCriteriaDto;
 }

+export class CreateWebhookDto {
+  @ApiProperty({ example: 'https://chat.example.org/hooks/taskstream' })
+  @IsUrl({ require_tld: false, require_protocol: true })
+  url!: string;
+
+  @ApiProperty({
+    type: [String],
+    example: ['issue.status_changed', 'release.*'],
+    description: 'Event names (GET /api/webhook-events), family.* or *',
+  })
+  @IsArray()
+  @ArrayMaxSize(50)
+  @IsString({ each: true })
+  events!: string[];
+}
+
+export class UpdateWebhookDto extends PartialType(CreateWebhookDto) {
+  @ApiPropertyOptional({ description: 'Paused webhooks get nothing' })
+  @IsOptional()
+  @IsBoolean()
+  active?: boolean;
+}
+
 export class RankIssueDto {
  @ApiPropertyOptional({
    type: String,
--- a/libs/api/tracker/presenters/src/lib/http/dto/responses.dto.ts
+++ b/libs/api/tracker/presenters/src/lib/http/dto/responses.dto.ts
@@ -167,6 +167,33 @@ export class GitIntegrationDto {
  @ApiProperty({ example: '/api/webhooks/git/3f2c…' }) webhookPath!: string;
 }

+export class WebhookDeliveryDto {
+  @ApiProperty({ format: 'date-time' }) at!: string;
+  @ApiProperty({ example: 'issue.created' }) event!: string;
+  @ApiProperty({ type: Number, nullable: true, description: 'HTTP status' })
+  status!: number | null;
+  @ApiProperty() ok!: boolean;
+  @ApiProperty({ type: String, nullable: true }) error!: string | null;
+}
+
+export class WebhookDto {
+  @ApiProperty({ format: 'uuid' }) id!: string;
+  @ApiProperty({ format: 'uuid' }) projectId!: string;
+  @ApiProperty() url!: string;
+  @ApiProperty({ type: [String] }) events!: string[];
+  @ApiProperty() active!: boolean;
+  @ApiProperty({ type: UserRefDto }) createdBy!: UserRefDto;
+  @ApiProperty({ format: 'date-time' }) createdAt!: string;
+  @ApiProperty({ type: WebhookDeliveryDto, nullable: true })
+  lastDelivery!: WebhookDeliveryDto | null;
+}
+
+export class WebhookCreatedDto {
+  @ApiProperty({ format: 'uuid' }) id!: string;
+  @ApiProperty({ description: 'Signs every delivery. Shown only now.' })
+  secret!: string;
+}
+
 export class GitDeliveryResultDto {
  @ApiProperty({ description: 'Tickets that got something new' })
  recorded!: number;
--- a/libs/api/tracker/presenters/src/lib/http/webhooks.controller.ts
+++ b/libs/api/tracker/presenters/src/lib/http/webhooks.controller.ts
@@ -0,0 +1,136 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  HttpCode,
+  Param,
+  ParseUUIDPipe,
+  Patch,
+  Post,
+} from '@nestjs/common';
+import {
+  ApiCreatedResponse,
+  ApiNoContentResponse,
+  ApiOkResponse,
+  ApiOperation,
+  ApiParam,
+  ApiTags,
+} from '@nestjs/swagger';
+import { User } from '@task-stream/api/identity/domain';
+import {
+  ApiPireonAuth,
+  CurrentUser,
+} from '@task-stream/api/identity/presenters';
+import {
+  ApiCommandErrors,
+  ApiReadErrors,
+} from '@task-stream/api/shared/presenters';
+import { WebhooksService } from '@task-stream/api/tracker/application';
+import { CreateWebhookDto, UpdateWebhookDto } from './dto/requests.dto';
+import {
+  WebhookCreatedDto,
+  WebhookDeliveryDto,
+  WebhookDto,
+} from './dto/responses.dto';
+import { Refs } from './refs';
+
+const WEBHOOK = ApiParam({ name: 'webhook', format: 'uuid' });
+
+/**
+ * Outgoing webhooks: a signed POST to another system when something happens
+ * in the project. Header `X-TaskStream-Signature: sha256=<HMAC of the body>`.
+ */
+@ApiTags('Webhooks')
+@ApiPireonAuth()
+@Controller()
+export class WebhooksController {
+  constructor(
+    private readonly webhooks: WebhooksService,
+    private readonly refs: Refs,
+  ) {}
+
+  @Get('webhook-events')
+  @ApiOperation({ summary: 'Event names a webhook can subscribe to' })
+  @ApiOkResponse({ type: [String] })
+  events() {
+    return this.webhooks.events();
+  }
+
+  @Get('projects/:project/webhooks')
+  @ApiParam({
+    name: 'project',
+    description: 'Project id or key',
+    example: 'WEB',
+  })
+  @ApiOperation({ summary: "The project's webhooks (owners and admins)" })
+  @ApiOkResponse({ type: [WebhookDto] })
+  @ApiReadErrors()
+  async list(@CurrentUser() me: User, @Param('project') project: string) {
+    return this.webhooks.list(me.id, await this.refs.projectId(me.id, project));
+  }
+
+  @Post('projects/:project/webhooks')
+  @ApiParam({
+    name: 'project',
+    description: 'Project id or key',
+    example: 'WEB',
+  })
+  @ApiOperation({
+    summary: 'Add a webhook',
+    description: 'The answer carries the secret, the only time it is shown.',
+  })
+  @ApiCreatedResponse({ type: WebhookCreatedDto })
+  @ApiCommandErrors()
+  async create(
+    @CurrentUser() me: User,
+    @Param('project') project: string,
+    @Body() body: CreateWebhookDto,
+  ) {
+    return this.webhooks.create(
+      me.id,
+      await this.refs.projectId(me.id, project),
+      body.url,
+      body.events,
+    );
+  }
+
+  @Patch('outgoing-webhooks/:webhook')
+  @WEBHOOK
+  @ApiOperation({ summary: 'Change the URL or the events, pause or resume' })
+  @ApiOkResponse({ type: WebhookDto })
+  @ApiCommandErrors()
+  update(
+    @CurrentUser() me: User,
+    @Param('webhook', ParseUUIDPipe) webhook: string,
+    @Body() body: UpdateWebhookDto,
+  ) {
+    return this.webhooks.update(me.id, webhook, body);
+  }
+
+  @Delete('outgoing-webhooks/:webhook')
+  @WEBHOOK
+  @HttpCode(204)
+  @ApiOperation({ summary: 'Delete a webhook' })
+  @ApiNoContentResponse()
+  @ApiCommandErrors()
+  async delete(
+    @CurrentUser() me: User,
+    @Param('webhook', ParseUUIDPipe) webhook: string,
+  ) {
+    await this.webhooks.delete(me.id, webhook);
+  }
+
+  @Post('outgoing-webhooks/:webhook/test')
+  @WEBHOOK
+  @HttpCode(200)
+  @ApiOperation({ summary: 'Send a ping now and tell how it went' })
+  @ApiOkResponse({ type: WebhookDeliveryDto })
+  @ApiCommandErrors()
+  test(
+    @CurrentUser() me: User,
+    @Param('webhook', ParseUUIDPipe) webhook: string,
+  ) {
+    return this.webhooks.test(me.id, webhook);
+  }
+}
--- a/libs/api/tracker/presenters/src/lib/tracker-presenters.module.ts
+++ b/libs/api/tracker/presenters/src/lib/tracker-presenters.module.ts
@@ -22,6 +22,8 @@ import { SprintResolver } from './graphql/sprint.resolver';
 import { SprintsController } from './http/sprints.controller';
 import { GitController } from './http/git.controller';
 import { GitResolver } from './graphql/git.resolver';
+import { WebhookResolver } from './graphql/webhook.resolver';
+import { WebhooksController } from './http/webhooks.controller';

 /**
 * Driving adapters of the tracker context: GraphQL (queries, mutations,
@@ -54,6 +56,7 @@ import { GitResolver } from './graphql/git.resolver';
    SavedFiltersController,
    SprintsController,
    GitController,
+    WebhooksController,
  ],
  providers: [
    Refs,
@@ -66,6 +69,7 @@ import { GitResolver } from './graphql/git.resolver';
    SavedFilterResolver,
    SprintResolver,
    GitResolver,
+    WebhookResolver,
  ],
 })
 export class TrackerPresentersModule {
--- a/libs/web/tracker/domain/src/lib/models/models.ts
+++ b/libs/web/tracker/domain/src/lib/models/models.ts
@@ -170,6 +170,27 @@ export interface DevLink {
  at: string;
 }

+export interface WebhookDelivery {
+  at: string;
+  event: string;
+  /** HTTP status, null when it never answered. */
+  status: number | null;
+  ok: boolean;
+  error: string | null;
+}
+
+/** Where the project tells another system what happened. */
+export interface Webhook {
+  id: string;
+  url: string;
+  /** Event names, `family.*` or `*`. */
+  events: string[];
+  active: boolean;
+  createdBy: UserRef;
+  createdAt: string;
+  lastDelivery: WebhookDelivery | null;
+}
+
 /** The project's webhook for GitHub, Gitea or GitLab. */
 export interface GitIntegration {
  enabled: boolean;
--- a/libs/web/tracker/domain/src/lib/ports/gateways.ts
+++ b/libs/web/tracker/domain/src/lib/ports/gateways.ts
@@ -6,6 +6,8 @@ import {
  Comment,
  Epic,
  GitIntegration,
+  Webhook,
+  WebhookDelivery,
  SavedFilter,
  Sprint,
  SprintBurndown,
@@ -131,6 +133,24 @@ export abstract class IssuesGateway {
  ): Observable<CommandResult>;
 }

+/** The project's outgoing webhooks (owners and admins). */
+export abstract class WebhooksGateway {
+  abstract list(projectId: string): Observable<Webhook[]>;
+  abstract events(): Observable<string[]>;
+  /** The secret comes back only here. */
+  abstract create(
+    projectId: string,
+    url: string,
+    events: string[],
+  ): Observable<{ id: string; secret: string }>;
+  abstract update(
+    webhookId: string,
+    changes: { url?: string; events?: string[]; active?: boolean },
+  ): Observable<Webhook>;
+  abstract remove(webhookId: string): Observable<void>;
+  abstract test(webhookId: string): Observable<WebhookDelivery>;
+}
+
 /** The project's Git webhook (owners and admins configure it). */
 export abstract class GitGateway {
  abstract integration(projectId: string): Observable<GitIntegration>;
--- a/libs/web/tracker/infrastructure/src/lib/adapters/graphql-webhooks.gateway.ts
+++ b/libs/web/tracker/infrastructure/src/lib/adapters/graphql-webhooks.gateway.ts
@@ -0,0 +1,64 @@
+import { inject, Injectable } from '@angular/core';
+import {
+  Webhook,
+  WebhookDelivery,
+  WebhooksGateway,
+} from '@task-stream/web/tracker/domain';
+import { map, Observable } from 'rxjs';
+import {
+  CreateWebhookDocument,
+  DeleteWebhookDocument,
+  TestWebhookDocument,
+  UpdateWebhookDocument,
+  WebhookEventsDocument,
+  WebhooksDocument,
+} from '../graphql/generated';
+import { GraphqlOperations } from './graphql-operations';
+
+@Injectable()
+export class GraphqlWebhooksGateway extends WebhooksGateway {
+  private readonly gql = inject(GraphqlOperations);
+
+  list(projectId: string): Observable<Webhook[]> {
+    return this.gql
+      .query(WebhooksDocument, { projectId })
+      .pipe(map((d) => d.webhooks as Webhook[]));
+  }
+
+  events(): Observable<string[]> {
+    return this.gql
+      .query(WebhookEventsDocument, {})
+      .pipe(map((d) => d.webhookEvents));
+  }
+
+  create(
+    projectId: string,
+    url: string,
+    events: string[],
+  ): Observable<{ id: string; secret: string }> {
+    return this.gql
+      .mutate(CreateWebhookDocument, { input: { projectId, url, events } })
+      .pipe(map((d) => d.createWebhook));
+  }
+
+  update(
+    webhookId: string,
+    changes: { url?: string; events?: string[]; active?: boolean },
+  ): Observable<Webhook> {
+    return this.gql
+      .mutate(UpdateWebhookDocument, { input: { webhookId, ...changes } })
+      .pipe(map((d) => d.updateWebhook as Webhook));
+  }
+
+  remove(webhookId: string): Observable<void> {
+    return this.gql
+      .mutate(DeleteWebhookDocument, { webhookId })
+      .pipe(map(() => undefined));
+  }
+
+  test(webhookId: string): Observable<WebhookDelivery> {
+    return this.gql
+      .mutate(TestWebhookDocument, { webhookId })
+      .pipe(map((d) => d.testWebhook));
+  }
+}
--- a/libs/web/tracker/infrastructure/src/lib/graphql/generated.ts
+++ b/libs/web/tracker/infrastructure/src/lib/graphql/generated.ts
@@ -75,6 +75,13 @@ export type CreateSprintInput = {
  startDate: string;
 };

+export type CreateWebhookInput = {
+  /** Event names, family.* or * */
+  events: Array<string>;
+  projectId: string;
+  url: string;
+};
+
 export type DevLinkKind = 'BRANCH' | 'COMMIT' | 'PULL_REQUEST';

 export type DevLinkState = 'CLOSED' | 'MERGED' | 'OPEN';
@@ -240,6 +247,13 @@ export type UpdateSprintInput = {
  startDate?: string | null | undefined;
 };

+export type UpdateWebhookInput = {
+  active?: boolean | null | undefined;
+  events?: Array<string> | null | undefined;
+  url?: string | null | undefined;
+  webhookId: string;
+};
+
 export type WorkflowStatusInput = {
  archived?: boolean;
  category: StatusCategory;
@@ -1656,6 +1670,106 @@ export type MyProjectsChangedSubscription = {
  };
 };

+export type WebhookFieldsFragment = {
+  id: string;
+  url: string;
+  events: Array<string>;
+  active: boolean;
+  createdAt: string;
+  createdBy: { id: string; name: string };
+  lastDelivery: {
+    at: string;
+    event: string;
+    status: number | null;
+    ok: boolean;
+    error: string | null;
+  } | null;
+};
+
+export type WebhookDeliveryFieldsFragment = {
+  at: string;
+  event: string;
+  status: number | null;
+  ok: boolean;
+  error: string | null;
+};
+
+export type WebhooksQueryVariables = Exact<{
+  projectId: string;
+}>;
+
+export type WebhooksQuery = {
+  webhooks: Array<{
+    id: string;
+    url: string;
+    events: Array<string>;
+    active: boolean;
+    createdAt: string;
+    createdBy: { id: string; name: string };
+    lastDelivery: {
+      at: string;
+      event: string;
+      status: number | null;
+      ok: boolean;
+      error: string | null;
+    } | null;
+  }>;
+};
+
+export type WebhookEventsQueryVariables = Exact<{ [key: string]: never }>;
+
+export type WebhookEventsQuery = { webhookEvents: Array<string> };
+
+export type CreateWebhookMutationVariables = Exact<{
+  input: CreateWebhookInput;
+}>;
+
+export type CreateWebhookMutation = {
+  createWebhook: { id: string; secret: string };
+};
+
+export type UpdateWebhookMutationVariables = Exact<{
+  input: UpdateWebhookInput;
+}>;
+
+export type UpdateWebhookMutation = {
+  updateWebhook: {
+    id: string;
+    url: string;
+    events: Array<string>;
+    active: boolean;
+    createdAt: string;
+    createdBy: { id: string; name: string };
+    lastDelivery: {
+      at: string;
+      event: string;
+      status: number | null;
+      ok: boolean;
+      error: string | null;
+    } | null;
+  };
+};
+
+export type DeleteWebhookMutationVariables = Exact<{
+  webhookId: string;
+}>;
+
+export type DeleteWebhookMutation = { deleteWebhook: boolean };
+
+export type TestWebhookMutationVariables = Exact<{
+  webhookId: string;
+}>;
+
+export type TestWebhookMutation = {
+  testWebhook: {
+    at: string;
+    event: string;
+    status: number | null;
+    ok: boolean;
+    error: string | null;
+  };
+};
+
 export const UserRefFieldsFragmentDoc = {
  kind: 'Document',
  definitions: [
@@ -2484,6 +2598,111 @@ export const SprintFieldsFragmentDoc = {
    },
  ],
 } as unknown as DocumentNode<SprintFieldsFragment, unknown>;
+export const WebhookDeliveryFieldsFragmentDoc = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'WebhookDeliveryFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'WebhookDelivery' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'at' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'event' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'status' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'ok' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'error' } },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<WebhookDeliveryFieldsFragment, unknown>;
+export const WebhookFieldsFragmentDoc = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'WebhookFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'Webhook' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'url' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'events' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'active' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'createdAt' } },
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'createdBy' },
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'FragmentSpread',
+                  name: { kind: 'Name', value: 'UserRefFields' },
+                },
+              ],
+            },
+          },
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'lastDelivery' },
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'FragmentSpread',
+                  name: { kind: 'Name', value: 'WebhookDeliveryFields' },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    },
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'UserRefFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'UserRef' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'name' } },
+        ],
+      },
+    },
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'WebhookDeliveryFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'WebhookDelivery' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'at' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'event' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'status' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'ok' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'error' } },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<WebhookFieldsFragment, unknown>;
 export const GitIntegrationDocument = {
  kind: 'Document',
  definitions: [
@@ -9995,3 +10214,450 @@ export const MyProjectsChangedDocument = {
  MyProjectsChangedSubscription,
  MyProjectsChangedSubscriptionVariables
 >;
+export const WebhooksDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'query',
+      name: { kind: 'Name', value: 'Webhooks' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: {
+            kind: 'Variable',
+            name: { kind: 'Name', value: 'projectId' },
+          },
+          type: {
+            kind: 'NonNullType',
+            type: { kind: 'NamedType', name: { kind: 'Name', value: 'ID' } },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'webhooks' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'projectId' },
+                value: {
+                  kind: 'Variable',
+                  name: { kind: 'Name', value: 'projectId' },
+                },
+              },
+            ],
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'FragmentSpread',
+                  name: { kind: 'Name', value: 'WebhookFields' },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    },
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'UserRefFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'UserRef' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'name' } },
+        ],
+      },
+    },
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'WebhookDeliveryFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'WebhookDelivery' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'at' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'event' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'status' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'ok' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'error' } },
+        ],
+      },
+    },
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'WebhookFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'Webhook' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'url' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'events' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'active' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'createdAt' } },
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'createdBy' },
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'FragmentSpread',
+                  name: { kind: 'Name', value: 'UserRefFields' },
+                },
+              ],
+            },
+          },
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'lastDelivery' },
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'FragmentSpread',
+                  name: { kind: 'Name', value: 'WebhookDeliveryFields' },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<WebhooksQuery, WebhooksQueryVariables>;
+export const WebhookEventsDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'query',
+      name: { kind: 'Name', value: 'WebhookEvents' },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'webhookEvents' } },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<WebhookEventsQuery, WebhookEventsQueryVariables>;
+export const CreateWebhookDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'mutation',
+      name: { kind: 'Name', value: 'CreateWebhook' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: {
+            kind: 'Variable',
+            name: { kind: 'Name', value: 'input' },
+          },
+          type: {
+            kind: 'NonNullType',
+            type: {
+              kind: 'NamedType',
+              name: { kind: 'Name', value: 'CreateWebhookInput' },
+            },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'createWebhook' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'input' },
+                value: {
+                  kind: 'Variable',
+                  name: { kind: 'Name', value: 'input' },
+                },
+              },
+            ],
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+                { kind: 'Field', name: { kind: 'Name', value: 'secret' } },
+              ],
+            },
+          },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<
+  CreateWebhookMutation,
+  CreateWebhookMutationVariables
+>;
+export const UpdateWebhookDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'mutation',
+      name: { kind: 'Name', value: 'UpdateWebhook' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: {
+            kind: 'Variable',
+            name: { kind: 'Name', value: 'input' },
+          },
+          type: {
+            kind: 'NonNullType',
+            type: {
+              kind: 'NamedType',
+              name: { kind: 'Name', value: 'UpdateWebhookInput' },
+            },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'updateWebhook' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'input' },
+                value: {
+                  kind: 'Variable',
+                  name: { kind: 'Name', value: 'input' },
+                },
+              },
+            ],
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'FragmentSpread',
+                  name: { kind: 'Name', value: 'WebhookFields' },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    },
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'UserRefFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'UserRef' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'name' } },
+        ],
+      },
+    },
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'WebhookDeliveryFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'WebhookDelivery' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'at' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'event' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'status' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'ok' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'error' } },
+        ],
+      },
+    },
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'WebhookFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'Webhook' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'id' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'url' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'events' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'active' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'createdAt' } },
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'createdBy' },
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'FragmentSpread',
+                  name: { kind: 'Name', value: 'UserRefFields' },
+                },
+              ],
+            },
+          },
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'lastDelivery' },
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'FragmentSpread',
+                  name: { kind: 'Name', value: 'WebhookDeliveryFields' },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<
+  UpdateWebhookMutation,
+  UpdateWebhookMutationVariables
+>;
+export const DeleteWebhookDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'mutation',
+      name: { kind: 'Name', value: 'DeleteWebhook' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: {
+            kind: 'Variable',
+            name: { kind: 'Name', value: 'webhookId' },
+          },
+          type: {
+            kind: 'NonNullType',
+            type: { kind: 'NamedType', name: { kind: 'Name', value: 'ID' } },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'deleteWebhook' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'webhookId' },
+                value: {
+                  kind: 'Variable',
+                  name: { kind: 'Name', value: 'webhookId' },
+                },
+              },
+            ],
+          },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<
+  DeleteWebhookMutation,
+  DeleteWebhookMutationVariables
+>;
+export const TestWebhookDocument = {
+  kind: 'Document',
+  definitions: [
+    {
+      kind: 'OperationDefinition',
+      operation: 'mutation',
+      name: { kind: 'Name', value: 'TestWebhook' },
+      variableDefinitions: [
+        {
+          kind: 'VariableDefinition',
+          variable: {
+            kind: 'Variable',
+            name: { kind: 'Name', value: 'webhookId' },
+          },
+          type: {
+            kind: 'NonNullType',
+            type: { kind: 'NamedType', name: { kind: 'Name', value: 'ID' } },
+          },
+        },
+      ],
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          {
+            kind: 'Field',
+            name: { kind: 'Name', value: 'testWebhook' },
+            arguments: [
+              {
+                kind: 'Argument',
+                name: { kind: 'Name', value: 'webhookId' },
+                value: {
+                  kind: 'Variable',
+                  name: { kind: 'Name', value: 'webhookId' },
+                },
+              },
+            ],
+            selectionSet: {
+              kind: 'SelectionSet',
+              selections: [
+                {
+                  kind: 'FragmentSpread',
+                  name: { kind: 'Name', value: 'WebhookDeliveryFields' },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    },
+    {
+      kind: 'FragmentDefinition',
+      name: { kind: 'Name', value: 'WebhookDeliveryFields' },
+      typeCondition: {
+        kind: 'NamedType',
+        name: { kind: 'Name', value: 'WebhookDelivery' },
+      },
+      selectionSet: {
+        kind: 'SelectionSet',
+        selections: [
+          { kind: 'Field', name: { kind: 'Name', value: 'at' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'event' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'status' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'ok' } },
+          { kind: 'Field', name: { kind: 'Name', value: 'error' } },
+        ],
+      },
+    },
+  ],
+} as unknown as DocumentNode<TestWebhookMutation, TestWebhookMutationVariables>;
--- a/libs/web/tracker/infrastructure/src/lib/graphql/webhooks.graphql
+++ b/libs/web/tracker/infrastructure/src/lib/graphql/webhooks.graphql
@@ -0,0 +1,54 @@
+fragment WebhookFields on Webhook {
+  id
+  url
+  events
+  active
+  createdAt
+  createdBy {
+    ...UserRefFields
+  }
+  lastDelivery {
+    ...WebhookDeliveryFields
+  }
+}
+
+fragment WebhookDeliveryFields on WebhookDelivery {
+  at
+  event
+  status
+  ok
+  error
+}
+
+query Webhooks($projectId: ID!) {
+  webhooks(projectId: $projectId) {
+    ...WebhookFields
+  }
+}
+
+query WebhookEvents {
+  webhookEvents
+}
+
+mutation CreateWebhook($input: CreateWebhookInput!) {
+  createWebhook(input: $input) {
+    id
+    secret
+  }
+}
+
+mutation UpdateWebhook($input: UpdateWebhookInput!) {
+  updateWebhook(input: $input) {
+    ...WebhookFields
+  }
+}
+
+mutation DeleteWebhook($webhookId: ID!) {
+  deleteWebhook(webhookId: $webhookId)
+}
+
+mutation TestWebhook($webhookId: ID!) {
+  testWebhook(webhookId: $webhookId) {
+    ...WebhookDeliveryFields
+  }
+}
--- a/libs/web/tracker/infrastructure/src/lib/tracker-infrastructure.providers.ts
+++ b/libs/web/tracker/infrastructure/src/lib/tracker-infrastructure.providers.ts
@@ -13,6 +13,7 @@ import {
  SavedFiltersGateway,
  SprintsGateway,
  GitGateway,
+  WebhooksGateway,
  TrackerRealtimeGateway,
  UsersGateway,
 } from '@task-stream/web/tracker/domain';
@@ -30,6 +31,7 @@ import { GraphqlRealtimeGateway } from './adapters/graphql-realtime.gateway';
 import { GraphqlSavedFiltersGateway } from './adapters/graphql-saved-filters.gateway';
 import { GraphqlSprintsGateway } from './adapters/graphql-sprints.gateway';
 import { GraphqlGitGateway } from './adapters/graphql-git.gateway';
+import { GraphqlWebhooksGateway } from './adapters/graphql-webhooks.gateway';

 /** Ports → GraphQL adapters (and REST for files). */
 export function provideTrackerInfrastructure(): EnvironmentProviders {
@@ -46,5 +48,6 @@ export function provideTrackerInfrastructure(): EnvironmentProviders {
    { provide: SavedFiltersGateway, useClass: GraphqlSavedFiltersGateway },
    { provide: SprintsGateway, useClass: GraphqlSprintsGateway },
    { provide: GitGateway, useClass: GraphqlGitGateway },
+    { provide: WebhooksGateway, useClass: GraphqlWebhooksGateway },
  ]);
 }
--- a/libs/web/tracker/presenters/src/lib/pages/settings.page.ts
+++ b/libs/web/tracker/presenters/src/lib/pages/settings.page.ts
@@ -17,6 +17,7 @@ import {
 import { NgTemplateOutlet } from '@angular/common';
 import { PiIconComponent, PiNoteComponent } from '@pi/ui';
 import { GitIntegrationComponent } from '../ui/git-integration';
+import { WebhooksComponent } from '../ui/webhooks';
 import { ProjectFacade } from '@task-stream/web/tracker/application';
 import {
  ProjectSettings,
@@ -53,6 +54,7 @@ function idFrom(name: string): string {
  changeDetection: ChangeDetectionStrategy.OnPush,
  imports: [
    GitIntegrationComponent,
+    WebhooksComponent,
    CdkDropList,
    CdkDrag,
    CdkDragHandle,
@@ -468,6 +470,7 @@ function idFrom(name: string): string {
          [projectId]="project.id"
          [projectKey]="project.key"
        />
+        <ts-webhooks [projectId]="project.id" />
      }

      @if (facade.isOwner() && facade.project(); as project) {
--- a/libs/web/tracker/presenters/src/lib/ui/webhooks.ts
+++ b/libs/web/tracker/presenters/src/lib/ui/webhooks.ts
@@ -0,0 +1,338 @@
+import {
+  ChangeDetectionStrategy,
+  Component,
+  DestroyRef,
+  effect,
+  inject,
+  input,
+  signal,
+  untracked,
+} from '@angular/core';
+import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+import { PiActionButtonComponent, PiTextFieldComponent } from '@pi/ui';
+import { ToastService } from '@task-stream/web/shared/ui';
+import { Webhook, WebhooksGateway } from '@task-stream/web/tracker/domain';
+import { timeAgo } from './copy';
+
+/** What each event means, in the words of the settings page. */
+const EVENT_LABEL: Record<string, string> = {
+  'issue.created': 'Ticket creado',
+  'issue.updated': 'Ticket editado',
+  'issue.status_changed': 'Cambio de estado',
+  'issue.assigned': 'Asignación',
+  'issue.sprint_changed': 'Entra o sale de un sprint',
+  'issue.release_changed': 'Entra o sale de una release',
+  'issue.dev_link': 'Commit, rama o PR',
+  'issue.deleted': 'Ticket borrado',
+  'comment.added': 'Comentario',
+  'comment.edited': 'Comentario editado',
+  'comment.deleted': 'Comentario borrado',
+  'release.created': 'Release creada',
+  'release.shipped': 'Release publicada',
+  'release.archived': 'Release archivada',
+  'sprint.started': 'Sprint empezado',
+  'sprint.closed': 'Sprint cerrado',
+};
+
+/** Settings card: signed POSTs to other systems when things happen. */
+@Component({
+  selector: 'ts-webhooks',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [PiActionButtonComponent, PiTextFieldComponent],
+  template: `
+    <section class="ts-panel ts-block ts-hooks" aria-labelledby="hooks-title">
+      <div>
+        <h3 id="hooks-title">Webhooks</h3>
+        <p class="ts-muted">
+          Avisa a otro sistema (un chat, un CI, un script) de lo que pasa en el
+          proyecto: un <code>POST</code> en JSON firmado con
+          <code>X-TaskStream-Signature: sha256=…</code> (HMAC del cuerpo con el
+          secreto).
+        </p>
+      </div>
+
+      @if (secret(); as shown) {
+        <p class="ts-hooks__secret" role="status">
+          Secreto del webhook nuevo (no se volverá a mostrar):
+          <code>{{ shown }}</code>
+          <button type="button" class="ts-plain-link" (click)="copy(shown)">
+            Copiar
+          </button>
+        </p>
+      }
+
+      @for (hook of hooks(); track hook.id) {
+        <article class="ts-hooks__item" [class.is-paused]="!hook.active">
+          <div class="ts-hooks__head">
+            <code class="ts-hooks__url">{{ hook.url }}</code>
+            @if (!hook.active) {
+              <span class="ts-pill">En pausa</span>
+            }
+          </div>
+          <p class="ts-muted ts-hooks__events">
+            {{ eventsLabel(hook.events) }}
+          </p>
+          @if (hook.lastDelivery; as last) {
+            <p class="ts-hooks__last" [class.is-bad]="!last.ok">
+              Último envío ({{ last.event }}) {{ ago(last.at) }}:
+              {{ last.ok ? 'OK ' + last.status : (last.error ?? 'falló') }}
+            </p>
+          }
+          <div class="ts-hooks__actions">
+            <pi-action-button
+              size="small"
+              color="grey"
+              appearance="outline"
+              text="Probar"
+              (execute)="test(hook)"
+            />
+            <pi-action-button
+              size="small"
+              color="grey"
+              appearance="ghost"
+              [text]="hook.active ? 'Pausar' : 'Reanudar'"
+              (execute)="toggle(hook)"
+            />
+            <pi-action-button
+              size="small"
+              color="grey"
+              appearance="ghost"
+              text="Borrar"
+              (execute)="remove(hook)"
+            />
+          </div>
+        </article>
+      }
+
+      <form
+        class="ts-hooks__new"
+        (submit)="$event.preventDefault(); create()"
+        novalidate
+      >
+        <pi-text-field placeholder="https://…" [(value)]="url" />
+        <fieldset class="ts-hooks__picks">
+          <legend>Eventos</legend>
+          <label>
+            <input
+              type="checkbox"
+              [checked]="picked().includes('*')"
+              (change)="pick('*', $any($event.target).checked)"
+            />
+            Todos
+          </label>
+          @for (event of events(); track event) {
+            <label>
+              <input
+                type="checkbox"
+                [disabled]="picked().includes('*')"
+                [checked]="picked().includes(event)"
+                (change)="pick(event, $any($event.target).checked)"
+              />
+              {{ label(event) }}
+            </label>
+          }
+        </fieldset>
+        <div>
+          <pi-action-button
+            size="small"
+            color="primary"
+            text="Añadir webhook"
+            [disabled]="!url().trim() || !picked().length"
+            (execute)="create()"
+          />
+        </div>
+      </form>
+    </section>
+  `,
+  styles: `
+    .ts-hooks {
+      display: grid;
+      gap: 0.75rem;
+      h3 {
+        margin: 0 0 0.25rem;
+      }
+    }
+    .ts-hooks__secret {
+      margin: 0;
+      padding: 0.5rem 0.75rem;
+      border-radius: 0.5rem;
+      background: color-mix(in srgb, var(--ts-brand) 10%, transparent);
+      code {
+        overflow-wrap: anywhere;
+      }
+    }
+    .ts-hooks__item {
+      display: grid;
+      gap: 0.25rem;
+      padding: 0.625rem 0;
+      border-top: 1px solid var(--ts-line);
+      &.is-paused {
+        opacity: 0.7;
+      }
+      p {
+        margin: 0;
+      }
+    }
+    .ts-hooks__head {
+      display: flex;
+      gap: 0.5rem;
+      align-items: center;
+      min-width: 0;
+    }
+    .ts-hooks__url {
+      overflow-wrap: anywhere;
+    }
+    .ts-hooks__events,
+    .ts-hooks__last {
+      font-size: 0.8125rem;
+    }
+    .ts-hooks__last.is-bad {
+      color: var(--ts-c-red, var(--ts-ink));
+    }
+    .ts-hooks__actions {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 0.25rem;
+    }
+    .ts-hooks__new {
+      display: grid;
+      gap: 0.5rem;
+      padding-top: 0.75rem;
+      border-top: 1px solid var(--ts-line);
+    }
+    .ts-hooks__picks {
+      display: grid;
+      grid-template-columns: repeat(auto-fill, minmax(12rem, 1fr));
+      gap: 0.25rem 1rem;
+      margin: 0;
+      padding: 0;
+      border: 0;
+      font-size: 0.875rem;
+      legend {
+        margin-bottom: 0.25rem;
+        color: var(--ts-muted);
+      }
+      label {
+        display: flex;
+        gap: 0.375rem;
+        align-items: center;
+      }
+    }
+  `,
+})
+export class WebhooksComponent {
+  readonly projectId = input.required<string>();
+
+  private readonly gateway = inject(WebhooksGateway);
+  private readonly toast = inject(ToastService);
+  private readonly destroyRef = inject(DestroyRef);
+  protected readonly hooks = signal<Webhook[]>([]);
+  protected readonly events = signal<string[]>([]);
+  protected readonly url = signal('');
+  protected readonly picked = signal<string[]>(['issue.status_changed']);
+  protected readonly secret = signal<string | null>(null);
+  protected readonly ago = timeAgo;
+
+  constructor() {
+    this.gateway
+      .events()
+      .pipe(takeUntilDestroyed())
+      .subscribe((events) => this.events.set(events));
+    effect(() => {
+      const projectId = this.projectId();
+      untracked(() => this.reload(projectId));
+    });
+  }
+
+  protected label = (event: string) => EVENT_LABEL[event] ?? event;
+  protected eventsLabel(events: string[]): string {
+    return events.includes('*')
+      ? 'Todos los eventos'
+      : events.map((e) => this.label(e)).join(' · ');
+  }
+
+  protected pick(event: string, on: boolean): void {
+    this.picked.update((list) =>
+      on ? [...new Set([...list, event])] : list.filter((e) => e !== event),
+    );
+  }
+
+  protected create(): void {
+    const url = this.url().trim();
+    if (!url || !this.picked().length) return;
+    const events = this.picked().includes('*') ? ['*'] : this.picked();
+    this.gateway
+      .create(this.projectId(), url, events)
+      .pipe(takeUntilDestroyed(this.destroyRef))
+      .subscribe({
+        next: ({ secret }) => {
+          this.secret.set(secret);
+          this.url.set('');
+          this.reload(this.projectId());
+        },
+        error: (error) => this.fail(error, 'No se pudo añadir'),
+      });
+  }
+
+  protected toggle(hook: Webhook): void {
+    this.gateway
+      .update(hook.id, { active: !hook.active })
+      .pipe(takeUntilDestroyed(this.destroyRef))
+      .subscribe({
+        next: () => this.reload(this.projectId()),
+        error: (error) => this.fail(error, 'No se pudo cambiar'),
+      });
+  }
+
+  protected remove(hook: Webhook): void {
+    if (!confirm(`¿Borrar el webhook a ${hook.url}?`)) return;
+    this.gateway
+      .remove(hook.id)
+      .pipe(takeUntilDestroyed(this.destroyRef))
+      .subscribe({
+        next: () => this.reload(this.projectId()),
+        error: (error) => this.fail(error, 'No se pudo borrar'),
+      });
+  }
+
+  protected test(hook: Webhook): void {
+    this.gateway
+      .test(hook.id)
+      .pipe(takeUntilDestroyed(this.destroyRef))
+      .subscribe({
+        next: (delivery) => {
+          if (delivery.ok)
+            this.toast.success(`Ping entregado (${delivery.status})`);
+          else
+            this.toast.error(
+              `El ping falló: ${delivery.error ?? 'sin respuesta'}`,
+            );
+          this.reload(this.projectId());
+        },
+        error: (error) => this.fail(error, 'No se pudo probar'),
+      });
+  }
+
+  protected copy(text: string): void {
+    navigator.clipboard
+      ?.writeText(text)
+      .then(() => this.toast.success('Copiado'))
+      .catch(() => this.toast.error('No se pudo copiar'));
+  }
+
+  private reload(projectId: string): void {
+    this.gateway
+      .list(projectId)
+      .pipe(takeUntilDestroyed(this.destroyRef))
+      .subscribe({
+        next: (hooks) => this.hooks.set(hooks),
+        error: (error) => this.fail(error, 'No se pudieron leer los webhooks'),
+      });
+  }
+
+  private fail(error: unknown, fallback: string): void {
+    const message =
+      (error as { message?: string })?.message?.split('\n')[0] ?? fallback;
+    this.toast.error(message || fallback);
+  }
+}