pm_create_webhook
Create an outgoing webhook subscription for the current workspace. Every delivery is signed with HMAC-SHA256 of the raw body using the webhook secret, sent as X-Webhook-Signature-256: sha256=<hex>. Pass your own secret, or omit it and this tool generates one and returns it as secret in the result. SAVE THE SECRET IMMEDIATELY: pm_get_webhook / pm_list_webhooks never return it; to rotate it, pass a new secret to pm_update_webhook. Event types: Project Management events are dash-cased (e.g. "task-created", "task-status-changed", "comment-added"); wiki (Codexum) events are dotted and start with "wiki." (e.g. "wiki.page.published", "wiki.comment.added"); feature-request (Roadmarq) events start with "feedback." (e.g. "feedback.request.created", "feedback.bug.created"). Call pm_list_webhook_event_types for the full list with each type's product and allowed scopes. An unscoped webhook may mix products. Optionally narrow delivery to one entity with scopeType plus scopeEntityIdentifier: SPACE / FOLDER / TASK_LIST / TASK (identifier), WIKI_SPACE (space key), WIKI_PAGE (page id; covers its descendants), FEEDBACK_BOARD (board slug or id; stored and listed as the board UUID), FEEDBACK_REQUEST / FEEDBACK_BUG (short key such as "FR-12", or id); omit both for workspace-wide delivery. A scoped webhook may only list event types of its scope's product. Wiki and feature-request events need the API key to hold that product's read scope, and every delivery is re-checked: an event is sent only while the webhook creator can still see the item. Security bugs are not delivered to webhooks created with an API key: includeSecurityBugs can only be turned on by a workspace admin signed in as a person. Envelope: {version, id, type, timestamp, workspaceIdentifier, source ("pm" | "codexum" | "roadmarq"), eventId (stable across webhooks and replays; use it to de-duplicate), data}. Payloads are thin: no content bodies, comment text or emails. Retries fire at +0s / +1min / +5min (3 attempts total) and treat both 4xx and 5xx as failures. The URL must be publicly reachable: Dutify refuses private, loopback, link-local, CGNAT and IPv6 ULA addresses, localhost, bare hostnames and *.svc / *.cluster.local names (400 WEBHOOK_URL_NOT_ALLOWED) at create, update and resume, and re-checks it on every attempt. Redirects are not followed; http:// is accepted for public addresses. API-key scope: webhooks:write.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"url": "<url>",
"eventTypes": "<eventTypes>"
},
"name": "pm_create_webhook"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Public HTTPS endpoint that will receive POSTs | |
| name | No | Human-readable label for the webhook | |
| secret | No | Optional HMAC signing secret; omit it to get a generated one, returned once | |
| account | No | Multi-account auth only: name of the account from X-Dutify-Accounts to use for this call. Ignored in single-account mode (X-API-Key header). When multiple accounts are configured and this is omitted, the call fails with ACCOUNT_REQUIRED listing the available names. list_accounts never requires a selection. | |
| scopeType | No | Optional scope narrowing; requires scopeEntityIdentifier when set | |
| workspace | No | Workspace identifier or exact name for this call. Overrides the configured workspace. For personal keys, discover candidates with list_workspaces and select explicitly. Does not change other calls or expand a workspace key's access. | |
| eventTypes | Yes | Event names from pm_list_webhook_event_types, e.g. ["task-created", "wiki.page.published", "feedback.request.created"] | |
| scopeEntityIdentifier | No | The scoped entity: its identifier, a wiki space key, a board slug or id, or a request/bug short key (required when scopeType is set; requires scopeType) |