Workflows/Webhooks: answer 'what runs when, and what must I schedule?'
Ed asked whether making a ticket P1 fires the webhook by itself, or whether a
scheduled task has to go looking for it. The facts were all in the wiki but
scattered across two pages and written from the implementer's point of view —
neither page answered the reader's actual question.
Worse, the Webhooks 101 said a webhook means 'no polling, no delay', which is
true of DETECTION and wrong about DELIVERY (which sits in a queue until the cron
worker sends it). Read literally, it implies nothing needs scheduling — the
exact wrong conclusion, and the reason Ed's delivery worker had never run.
New section at the top of Workflows.md lays out all three cases plainly:
1. Something happened -> instant, event-driven, NOTHING to schedule.
2. A webhook needs sending -> the delivery worker MUST be scheduled, or
messages queue forever. Send test bypasses the queue, so it can pass while
every real webhook silently piles up unsent.
3. Time passed (SLA breach, contract expiry) -> not events at all; needs a
scheduler we haven't built. Also why no starter template offers SLA
escalation.
Webhooks 101 corrected with the same warning up front.
New page: Webhook Message Formats
A chat format is nothing but a JSON body template with a {{message}} slot, so
they're data now, not a PHP switch — add any platform without a release.
Covers: the idea; the five fields; ready-to-paste templates for Google Chat,
Mattermost, Rocket.Chat, ntfy, Telegram, PagerDuty and a Discord rich embed
(showing static fields and merge codes inside a template); the escaping
guarantee (decode -> substitute into values -> json_encode, never splice raw
text, with the injection test shown); the engine's hardcoded fallback; why the
built-ins are locked and Copy exists; and why the URL pattern and formatting
hint exist at all (both are bugs Ed hit today).
Webhooks.md section trimmed to a summary pointing here. Sidebar updated.
Webhooks: message formats are data — add your own platform
A chat preset is just a JSON body template with a {{message}} slot, so they're
rows now, not a PHP switch. Covers the four fields, why built-ins are locked,
the escaping guarantee (decode -> substitute into values -> json_encode, never
splice raw text), and the hardcoded fallback.
Workflows/Webhooks: templates, dry run, merge codes, encryption, retention + 2 new pages
Workflows.md: starter templates (with the name->id resolver design), dry run,
and a rewritten merge-codes section explaining why the picker is scoped to the
trigger (renderTemplate resolves unknown paths to an EMPTY STRING, so an
unavailable code fails silently). Refreshed "what's still ahead".
Webhooks.md: new "Data protection" section — URL + signing secret encrypted at
rest, URL redacted in the delivery log, the VARCHAR(2000) width requirement,
why the secret is NOT masked in the editor, and payload retention (default 7d)
vs row retention (30d) with the Replay trade-off stated. Plus a TLS
troubleshooting pointer.
New: HTTPS-Certificates-and-CA-Bundles.md — what certificate verification is,
what a CA bundle is in plain English, why Windows hits this, the fix (both
php.ini files), how to verify, and why "just disable SSL verification" is the
wrong answer.
New: Workflow-and-Webhook-Pitfalls.md — seven real bugs, their causes and
fixes. Five were INVISIBLE in production (nothing crashed, no test would have
failed). Meta-lesson: build the thing that makes the class of bug impossible
and it hands you the instances for free.
Sidebar: both new pages nested under Workflows.
Webhooks: note the delivery overview dashboard (#739)
The System → Webhooks page now opens with an at-a-glance health panel (7-day
success rate, volume, avg delivery time, queued/dead-letter, a 14-day chart, and
top endpoints/workflows) above the delivery log.
Webhooks: document Full-record preset + {{entity.full}} across 11 record types (#738)
Expanded "The payload" section to describe all four formats (Slack/Teams/Discord,
Custom, Full record) and the {{entity.full}} variable, listing the 11 supported
resources and noting cmdb.object.* / network_diagram.* are deferred.
Webhooks: complete the settings-event catalogue (#737)
Every module's settings lookups now have .created/.updated/.deleted triggers.
Added catalogue rows for tickets/assets/change/problem/task/CMDB/contracts
settings, supplier contacts, software licences and a new Network Mapper section;
removed the "more settings triggers coming" note now that the sweep is complete.
Webhooks: expand event catalogue (contracts/calendar/service-status/software/morning-checks + lifecycle delete/update) + searchable trigger picker
Add Webhooks page (101 + workflow integration + event catalogue + service-layer unlock)