fix(GitLab): GitLab webhooks not reaching our API

[emyller]

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Closes #7355

Fix our API URL in GitLab webhooks so they actually point to the API.

How did you test this code?

I will once in production.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 28, 2026 3:23pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ignored	Preview	Apr 28, 2026 3:23pm
flagsmith-frontend-staging	Ignored	Preview	Apr 28, 2026 3:23pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.43%. Comparing base (e44ea99) to head (6177917).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7357      +/-   ##
==========================================
- Coverage   98.43%   98.43%   -0.01%     
==========================================
  Files        1395     1395              
  Lines       52514    52513       -1     
==========================================
- Hits        51691    51690       -1     
  Misses        823      823              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, reopen this pull request to trigger a review.

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-7357	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-7357	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api:pr-7357	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-7357	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-7357	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-frontend:pr-7357	Finished ✅	Results ✅

[github-actions]

Playwright Test Results (oss - depot-ubuntu-latest-16)

 11 passed

Details

 11 tests across 8 suites
 39.8 seconds
 6177917
 🔄 Run: #16388 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 11 passed

Details

 11 tests across 8 suites
 1 second
 6177917
 🔄 Run: #16388 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 17 passed

Details

 17 tests across 14 suites
 59.1 seconds
 6177917
 🔄 Run: #16388 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 17 passed

Details

 17 tests across 14 suites
 1 minute, 1 second
 6177917
 🔄 Run: #16388 (attempt 1)

[github-actions]

Visual Regression

16 screenshots compared. See report for details.
View full report

[khvn26]

The OAuth approach almost looks more correct to me:

flagsmith/api/oauth2_metadata/dataclasses.py

Lines 21 to 22 in e44ea99

	api_url=settings.FLAGSMITH_API_URL.rstrip("/"),
	frontend_url=settings.FLAGSMITH_FRONTEND_URL.rstrip("/"),

However, the implication of having to properly document the setting, and update it for every single installation, is unpleasant.

Approving as a compromise before we figure our a common approach to this — that could include patching webhooks through FE, or figuring out django sites configuration for split FE/API installations.