feat: Mixpanel cohort sync webhook

[gagantrivedi]

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Contributes to https://github.com/Flagsmith/flagsmith-private/issues/261

Adds the receiving end of Mixpanel's Custom Webhook cohort sync, on top of the Amplitude branch (#8290):

• One webhook endpoint handling Mixpanel's members, add_members and remove_members actions, answering in the {action, status} envelope Mixpanel expects.
• A members first sync creates the cohort on the fly, keyed by a new Cohort.external_id; snapshot pages are treated as adds only.
• The sync key can now also be sent as the password of Basic credentials, since Mixpanel's webhook form only offers username/password.
• Failure responses carry the validation errors and emit a sync_webhook.rejected event.

How did you test this code?

Unit tests for the webhook actions, cohort auto-creation (including the simultaneous-creation and deleted-cohort cases), Basic credential handling, and cross-environment isolation; 100% coverage on the cohorts app. The real integration test happens against Mixpanel once the endpoint is deployed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Aug 26, 2026 9:16am
flagsmith-frontend-preview	Ignored	Preview	Aug 26, 2026 9:16am
flagsmith-frontend-staging	Ignored	Preview	Aug 26, 2026 9:16am

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2bc765ec-a3a1-458a-9c24-412435dcc36c

📥 Commits

Reviewing files that changed from the base of the PR and between e98fd87 and 0bbd178.

📒 Files selected for processing (3)

• api/cohorts/sync_views.py
• api/tests/unit/cohorts/test_sync_views.py
• openapi.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds Mixpanel cohort synchronisation through a webhook endpoint. It supports Bearer and Basic authentication. Cohorts store optional external identifiers and support the Mixpanel source type. The webhook handles cohort creation, reuse, member additions, removals, validation failures, and rejection logging. API documentation, observability records, fixtures, and tests are updated.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to 0bbd1

The webhook adds automatic cohort creation and asynchronous membership updates. At the current head, concurrent initial syncs can create duplicate cohorts, membership work may run before writes commit, and the new authentication scheme naming may break generated API schemas; these bounded correctness and integration risks should be fixed or explicitly accepted before merge.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.80%. Comparing base (b9b32ba) to head (0bbd178).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #8338    +/-   ##
========================================
  Coverage   98.79%   98.80%            
========================================
  Files        1616     1617     +1     
  Lines       65283    65556   +273     
========================================
+ Hits        64499    64772   +273     
  Misses        784      784            

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-8338	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-8338	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api:pr-8338	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-8338	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8338	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-frontend:pr-8338	Finished ✅	Results ✅

[github-actions]

❌ private-cloud · depot-ubuntu-latest-arm-16 — run #19798 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 failed
 1 passed

Details

 2 tests across 2 suites
 1 minute, 1 second
 81b0e17
 📦 Artifacts: View test results and HTML report
🔄 Run: #19798 (attempt 1)

Failed tests

firefox › tests/environment-permission-test.pw.ts › Environment Permission Tests › Environment-level permissions control access to features, identities, and segments @enterprise

🗂️ Previous results

✅ private-cloud · depot-ubuntu-latest-16 — run #19798 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 4 passed

Details

 4 tests across 4 suites
 32.6 seconds
 81b0e17
 🔄 Run: #19798 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19799 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 46.2 seconds
 0bbd178
 🔄 Run: #19799 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19798 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 45.8 seconds
 81b0e17
 🔄 Run: #19798 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19799 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 33.4 seconds
 0bbd178
 🔄 Run: #19799 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19798 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 34.6 seconds
 81b0e17
 🔄 Run: #19798 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #19797 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 48.1 seconds
 e98fd87
 🔄 Run: #19797 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #19797 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 36.8 seconds
 e98fd87
 🔄 Run: #19797 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19797 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 45.9 seconds
 e98fd87
 🔄 Run: #19797 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19797 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 40.6 seconds
 e98fd87
 🔄 Run: #19797 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19727 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 36.9 seconds
 10d6468
 🔄 Run: #19727 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19727 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 41.8 seconds
 10d6468
 🔄 Run: #19727 (attempt 1)

[github-actions]

Visual Regression

19 screenshots compared. See report for details.
View full report

[gagantrivedi]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f3174a6d-ff87-4af4-8e84-088565d372fa

📥 Commits

Reviewing files that changed from the base of the PR and between b7a2a70 and 10d6468.

📒 Files selected for processing (3)

• api/cohorts/serializers.py
• api/tests/unit/cohorts/test_sync_views.py
• openapi.yaml

💤 Files with no reviewable changes (1)

• openapi.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

[Zaimwa9]

Looks good, just needs to mirror the plan gating and max allowed segment.

Also shared my opinion on adding some robustness regarding the decision to drop the unique constraint

[Zaimwa9]

👏