{"record":{"id":"a62788bb0d4b7905","repo":"Significant-Gravitas/AutoGPT","slug":"webhook-not-found","errorCode":null,"errorMessage":"Webhook not found","messagePattern":"Webhook not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"warning","filePath":"autogpt_platform/backend/backend/api/features/integrations/router.py","lineNumber":787,"sourceCode":"            preset, webhook, webhook_id, event_type, payload\n        )\n        for preset in webhook.triggered_presets\n    )\n\n    if tasks:\n        await asyncio.gather(*tasks, return_exceptions=True)\n\n\n@router.post(\"/webhooks/{webhook_id}/ping\")\nasync def webhook_ping(\n    webhook_id: Annotated[str, Path(title=\"Our ID for the webhook\")],\n    user_id: Annotated[str, Security(get_user_id)],  # require auth\n):\n    webhook = await get_webhook(webhook_id)\n    if webhook.user_id != user_id:\n        # Treat a webhook the caller doesn't own as if it doesn't exist, so this\n        # endpoint can't be used to enumerate webhook IDs or ping others' webhooks.\n        raise HTTPException(\n            status_code=status.HTTP_404_NOT_FOUND, detail=\"Webhook not found\"\n        )\n    webhook_manager = get_webhook_manager(webhook.provider)\n\n    credentials = (\n        await creds_manager.get(user_id, webhook.credentials_id)\n        if webhook.credentials_id\n        else None\n    )\n    try:\n        await webhook_manager.trigger_ping(webhook, credentials)\n    except NotImplementedError:\n        return False\n\n    if not await wait_for_webhook_event(webhook_id, event_type=\"ping\", timeout=10):\n        raise HTTPException(\n            status_code=status.HTTP_504_GATEWAY_TIMEOUT, detail=\"Webhook ping timed out\"\n        )","sourceCodeStart":769,"sourceCodeEnd":805,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/integrations/router.py#L769-L805","documentation":"POST /integrations/webhooks/{webhook_id}/ping requires auth (get_user_id). It fetches the webhook and, if webhook.user_id differs from the authenticated caller, returns HTTP 404 'Webhook not found' rather than 403. Treating webhooks you don't own as nonexistent prevents using this endpoint to enumerate webhook IDs or ping other users' webhooks. A genuinely missing webhook produces the same response via get_webhook's NotFoundError path.","triggerScenarios":"Calling ping with a webhook_id owned by another user; using a JWT from user A while the webhook was registered by user B (e.g. admin tooling or a shared test suite hitting a production DB); a webhook_id that was deleted or never existed.","commonSituations":"Team environments where a teammate registered the webhook and you copied its ID into your script; expired Supabase session pointing at a different user than expected; copy-paste of webhook IDs between environments (dev URL + prod ID).","solutions":["List your own webhooks (GET /integrations/webhooks) and use an ID from that list — those are guaranteed owned by the authenticated user.","Verify the auth token you're sending belongs to the user who registered the webhook.","If the webhook was registered by another user, have that user ping it or re-register your own.","If testing cross-user flows is intentional, re-register the webhook under the test user instead of reusing an ID."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Only ping webhooks owned by the authenticated user\nowned = {w[\"id\"] for w in (await client.get(\"/integrations/webhooks\")).json()}\nif webhook_id not in owned:\n    skip_ping(webhook_id)  # 404 by design for foreign/missing IDs","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always source webhook IDs from the authenticated user's own list response.","Keep per-environment credential/ID stores separate so dev scripts never use prod IDs.","Remember the 404 intentionally masks 'not yours' — don't try to distinguish it."],"tags":["webhook","http-404","authorization","ping"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}