How to Update Automation Webhooks in Jira to the New Format
Atlassian has enhanced and updated webhooks in Jira to implement additional security. While this is a positive change, it requires updating all existing webhooks in your system. This tutorial will guide you through the process of identifying and updating affected webhooks. This new format will be in place for any webhook created after January 28, 2025 and all prior webhook calls must be updated prior to May 30, 2025.
Step 1: Determine Whether You Are Affected by the Webhook Change
To identify if your system is affected, follow these steps:
1.1. Navigate to System Settings
- Click the Cog wheel in the upper-right corner.
- Select System.
- In the left-hand menu, click Global Automations.
1.2. Find Affected Webhooks
- Depending on your system configuration, choose one of the following methods:
- Option 1: If available, click Trigger and select Incoming Webhook. This will display all automations using webhooks that need updating. (Note: The “Trigger” feature is new and may not be available in all systems.)
- Option 2: If “Trigger” is not available, search for webhooks manually:
- Search for “Send Web Request” under the Action step.
- Evaluate each “Send Web Request” call to see if is calling a webhook.
- (Note that this search will find all API or external calls, not just webhooks. You must evaluate each call to determine if it uses a webhook. If the Send Web Request does not provide a hint as to what the automation was called at creation, you may need to look at your automations to find the match.)
Step 2: Update the Webhook Triggers
- You will need to keep track of your URL’s for matching purposes. Take a copy of each URL and secret before making changes.
- Navigate to each automation whose trigger is set to Incoming Webhook.
- For each webhook:
- Save the information in the current trigger step. This will help you match your trigger to your calls in a later step.
- Click Regenerate on the trigger step. This will regenerate the secret (note that only the secret changes, not the URL).
- Copy the new webhook URL and secret to use in the calling automation.
Step 3: Update All “Send Web Request” Calls
- For each automation that calls a webhook, update the “Send Web Request” step as follows:
- Paste the updated webhook URL into the URL field.
(Note: the rules for passing issue keys have not changed. If your prior URL had the issue key passed, you will need to add that to your new URL as well) - Add a new header with the following details:
- Header Name: X-Automation-Webhook-Token
- Header Value: Your regenerated secret.
Conclusion
By following these steps, you can ensure all of your webhooks are updated to work with Atlassian’s new security enhancements. If you encounter issues or have questions, refer to Atlassian’s support documentation or contact your system administrator for further assistance.