PSA for changes to Webhook Automation trigger URLs February 2025 (adding a Secret)

[Rodney Dsouza _Atlassian Certified Expert_]

Atlassian recently announced that we need to add/use a Secret in Webhook calls as seen here:https://support.atlassian.com/cloud-automation/docs/configure-the-incoming-webhook-trigger-in-atlassian-automation/?jobid=106955371&subid=1754929739

What is not obvious, and could cause a lot of confusion, is that it seems like existing Webhook Automation rules have already been rewritten by Atlassian.  So, if you are used to looking at the URLs for your existing Webhooks, you will be very confused.

Let's say you have 

(1) a webhook automation url with url:  https://automation.atlassian.com/pro/hooks/e6abfd5353d7090b2794248aed22633218500123

and 

(2) you call that webhook from a different Automation rule with a "Send web request" Action.    Great.  This has worked for months and maybe years.

You would normally trace #2 to #1 by looking into your 2 rules (or 20 if you have a lot) and matching up the URL.

TODAY YOU WOULD NOT BE ABLE TO FIND THE CONNECTION !

This is because Atlassian has apparently already rewritten the URL in for #1 as new URL.

I was going nuts trying to figure out what happened.

The good news that you can still find the "legacy url" in #1.   Just look for "View your legacy Webhook URL" further down in the Webhook automation.  You can use that to trace your way around existing automation rules.

This change does not seem to have been documented in any place obvious.

[Anthony]

@Rodney Dsouza _Atlassian Certified Expert_  Thank you for taking time writing this explanation.

The issue that we have here is, that on some of the Incoming Webhook Automations the "View your legacy Webhook URL" is missing. On others it shows up. Can anybody else confirm? If yes, why is it like that? Both Incoming Triggers setups are identical.

[Rodney Dsouza _Atlassian Certified Expert_]

That is a bit weird.   

Maybe the 2nd Automation Rule (without the "View your Legacy Webhook URL") was created after 28 January 2025?

[Martin König_ext__]

yep, same issue on my side. some rules shows the legacy, some dont even if created before 28 January 2025  (most of my cases are created 2024...)

looks to me like the "key-capable-part" of the legacy URL is the new secret for the new webhook url 

Submitting PCSticket right now, will keep you posted.

----

confirmed
secret is set to the legacy webhook ID.

example:

OLD ENDPOINT

automation.atlassian.com/pro/hooks/12345

NEW ENDPOINT
api-private.atlassian.com/automation/webhooks/jira/a/789101112131415
secret: 12345