Managing webhooks
Async webhooks are now default in Jira Data Center
Starting from Jira Data Center 10.0.0, asynchronous webhooks are now the default and only option. This update significantly improves the user experience by processing webhooks through a dedicated thread pool, rather than tying them to the user request. Previously, in Jira 9 and earlier, webhooks were processed synchronously, with the most computationally intensive work performed during the HTTP request.
Environments with exceptional webhook usage in both Jira 9 and 10 might exceed the guardrails set by the default parameters. You can customize these limits to better suit your organization’s needs. We recommend testing the asynchronous webhooks within your staging environments before a final upgrade. If you experience any issues, check our list of known problems or reach out to our support team.
Explore how to tune webhook performance parameters in Jira
Securing your webhook
You can secure your webhook using a secret token or by using basic authentication.
Secret token: Use secret tokens to authenticate the payload and ensure that contents are not tampered between Jira and your endpoint. Combined with HTTPS, it helps ensure the message transmitted is the one that Jira intended to send.
When you define a secret for a webhook, each request is signed via a Hash-based Message Authentication Code (HMAC). The default for this algorithm is HMACSha256. The header X-Hub-Signature is defined and contains the HMAC. For example, the header of the POST request would be plain text encoded as follows:
x-hub-signature: sha256=c3383246d4fd871e66e962b50cc12222222222222222222222222222222222To authenticate the validity of the message payload, the receiver can perform the HMAC algorithm on the received body with the secret as the key to the HMAC algorithm. If the results do not match, it may indicate there was a problem with transmission that has caused the message payload to change.
Managing webhooks in Jira
- Log in as a user with the Jira Administrators global permission.
- In the upper-right corner of the screen, select Administration
, then System. - Under Advanced (the left-side panel), select WebHooks to open the Webhooks page, which shows a list of all existing webhooks.
- Here's a few tips on using this page:
- Click the summary of the webhook in the left 'Webhooks' column to display the details of the webhook. You can edit, delete and disable it via the details panel.
- Deleting a webhook removes it permanently. If you just want to prevent it from firing, disable the webhook instead.
