IncomingWebhookState
An incoming webhook endpoint configuration
Unique identifier
nameString!Display name for the webhook
slugString!URL path segment (used in /api/hooks/{slug})
pathString!Route this endpoint answers on, e.g. /api/hooks/my-hook
urlStringAbsolute URL this endpoint is reachable at. Null when the server cannot determine one — no public base URL configured, or a controller-bound endpoint whose controller has no host recorded. Fall back to path rather than assembling an origin client-side.
activeBoolean!Whether the endpoint is enabled
HTTP methods this endpoint accepts
Authentication strategy
authConfigString!Non-secret authentication settings (JSON), e.g. hmacHeaderName. The secret itself is never returned in any form — not even masked, because a masked value is still one a client can send back over the stored one. Whether a secret is set is answered by hasAuthSecret.
hasAuthSecretBoolean!Whether a secret is stored for the current strategy. Always false for NONE. The value itself is never returned.
When the stored secret last changed (ISO8601); null when nothing is stored, or when it was last written before the platform recorded this.
scriptBodyString!Lua script to execute when the endpoint is called
timeoutMsInt!Execution timeout in milliseconds
Bot user ID for webhook execution identity
Controller ID for on-premise binding
createdAtString!Creation timestamp (ISO8601)
updatedAtString!Last update timestamp (ISO8601)
View exact SDL
"""An incoming webhook endpoint configuration"""
type IncomingWebhookState @iac_resource(name: "incoming_webhook") @iac_ops(create: "createIncomingWebhook", read: "getIncomingWebhook", update: "updateIncomingWebhook", delete: "deleteIncomingWebhook") {
"""Unique identifier"""
id: IncomingWebhookID! @iac_identity(assignedBy: SERVER) @iac_computed
"""Display name for the webhook"""
name: String!
"""URL path segment (used in /api/hooks/{slug})"""
slug: String!
"""Route this endpoint answers on, e.g. /api/hooks/my-hook"""
path: String! @iac_computed
"""
Absolute URL this endpoint is reachable at. Null when the server cannot determine one — no public base URL configured, or a controller-bound endpoint whose controller has no host recorded. Fall back to `path` rather than assembling an origin client-side.
"""
url: String @iac_computed
"""Whether the endpoint is enabled"""
active: Boolean!
"""HTTP methods this endpoint accepts"""
allowedMethods: [WebhookHTTPMethod!]!
"""Authentication strategy"""
authStrategy: WebhookAuthStrategy!
"""
Non-secret authentication settings (JSON), e.g. `hmacHeaderName`. The secret itself is never returned in any form — not even masked, because a masked value is still one a client can send back over the stored one. Whether a secret is set is answered by `hasAuthSecret`.
"""
authConfig: String! @iac_compare(as: JSON)
"""
Whether a secret is stored for the current strategy. Always false for NONE. The value itself is never returned.
"""
hasAuthSecret: Boolean! @iac_computed
"""
When the stored secret last changed (ISO8601); null when nothing is stored, or when it was last written before the platform recorded this.
"""
authSecretUpdatedAt: ISO8601 @iac_computed
"""Lua script to execute when the endpoint is called"""
scriptBody: String! @iac_artifact(language: LUA, testContract: "lua-normal.testing.json", validators: ["lua-typecheck"])
"""Execution timeout in milliseconds"""
timeoutMs: Int!
"""Bot user ID for webhook execution identity"""
botUserId: UserID @iac_ref(resource: "service_account")
"""Controller ID for on-premise binding"""
controllerId: ControllerID @iac_ref(resource: "controller")
"""Creation timestamp (ISO8601)"""
createdAt: String! @iac_computed
"""Last update timestamp (ISO8601)"""
updatedAt: String! @iac_computed
}One stable address across all schema views. Follow a field’s type to explore connections between domains.