topic Re: Managing org wide webhooks created by another user in Webex for Developers

Managing org wide webhooks created by another user

danield5s — Wed, 11 Oct 2023 04:43:00 GMT

As a Full Admin user I can use an integration to create an organization wide webhook (I am using webhooks for the "started" and "ended" events of the "meetings" resource).

If the org wide webhook already exists for the same appId, resource and event, then creating another webhook fails with 403 error "not allowed to create/update more than one org-level webhook for same resource!"
This is not a problem in itself as we don't want duplicate events. If there is an unused or incorrect org wide webhook subscription then it should first be deleted.

The problem is that, if there is an org wide webhook created by a different admin user, then deleting it fails with 403 error "Not allowed to delete webhook". Since it is an org wide webhook and prevents any other user from creating a webhook, I would expect any organization admin to be able to delete the webhook.

My concern is that when an admin is setting up an integration it may be possible to get into a scenario where the correct webhook cannot be created, especially if the user that had previously set up a webhook is not available.

Is it possible for a user to delete another user's org wide webhook?

Re: Managing org wide webhooks created by another user

Janos Benyovszki — Wed, 11 Oct 2023 08:52:04 GMT

@danield5s I just tested the same with my demo org and there I was able to delete an org level meetings webhook with admin B, that was created with admin A. Not sure if this is a user rights issue for you, but you can send us the details, like user emails and full API request, response to devsupport@webex.com and we can check further.

Re: Managing org wide webhooks created by another user

danield5s — Wed, 18 Oct 2023 07:00:10 GMT

Thank you, I've done more testing knowing that it should be possible but have still been unable to delete a webhook created by another user.

I tried using a user with all admin roles enabled including compliance officer.

I also tried adding the webhook read and write permissions to the integration, so that I can request a token with the spark-compliance:webhooks_read and spark-compliance:webhooks_write scopes.

I will send more details via email.

Re: Managing org wide webhooks created by another user

Janos Benyovszki — Wed, 18 Oct 2023 08:06:49 GMT

@danield5s thanks, got the ticket you opened, we will continue the troubleshooting there.