How to verify callback api is called by Jira Webhooks

[Abhinand Harshetty]

i have added callback url which will be called by jira. but how do i verify that is called from jira. 

is there any thing like token or certificate i need to verify

[Ankit Jain]

Jira does not support this. Ideally, this is done by sanding a crypto/secure-hash of the payload in the request headers. Atlassian should add this to their product roadmap. (You can try Beeceptor.com to review HTTP headers Jira is sending.)

In the absence of it.

• At a minimum, you should have a unique address (request path).
• Open a support ticket ti Jira and ask for their source IP addresses/range Validate it.

Ankit

[Dario B]

Hello @Abhinand Harshetty ,

I am not sure I have a correct understanding of what you are asking.

However, if you want to check whether or not a Webhook is correctly triggered, you can use beeceptor.com or webhook.site to verify this:

1. Use either beeceptor.com or webhook.site to create the callback url you will use for the test
2. Create an exact copy of the Webhook you want to verify, with the only difference that in here you will configure the callback url created in step #1 
3. Trigger the event that is supposed to fire the Webhook and see if the request is correctly received (in  beeceptor.com or webhook.site depending on what you used)

If this is not what you were trying to do, please provide more details.

Cheers,
Dario

[Nicolas Boyard]

He means anyone can call the endpoint thus mess up with the data, how to verify the request is genuine?