Studio incoming webhook https://URL/SECRET does not work

[Beau Herger]

The https://URL/SECRET workaround mentioned in Webhooks-Trigger-for-Atlassian-Automation does not seem to work for me in studio.atlassian automations.

❯ curl -i -X POST \
-H "X-Automation-Webhook-Token: FOO-TOKEN" \
-H "Content-Type: application/json" \
https://api.atlassian.com/automation/sc3/o/studio/t/workspace/i/***/webhooks/a/*** \
-d '{}'
HTTP/2 200

❯ curl -i -X POST \
-H "Content-Type: application/json" \
https://api.atlassian.com/automation/sc3/o/studio/t/workspace/i/***/webhooks/a/***/FOO-TOKEN \
-d '{}'
HTTP/2 404
...

{"timestamp":"2026-08-29T02:09:14.212477844Z","status":404,"error":"Not Found","message":"No message available","path":"/automation/sc3/o/studio/t/workspace/i/***/webhooks/a/***/FOO-TOKEN/"}%

[Robin Kon]

The 404 is a good clue since the same endpoint works with X-Automation-Webhook-Token. I’d stick with the header token for Studio for now rather than treating the secret as part of the URL.

[Beau Herger]

Unfortunately, this is not always an option to extend headers - even with Atlassian's own Bitbucket webhooks.  I would like to know if the advertised workaround is planned to be supported, or if this is merely a bug.