Provider webhooks

Provider modules can register a signed callback during OAuth. Linear is the current example with inbound webhook support.

Linear event flow

1. yggy generates a per-connection signing secret.
2. It registers /wh/linear/<provider-id> for Issue, Comment, and Project events.
3. Linear sends an event with a linear-signature header.
4. yggy verifies the HMAC-SHA256 signature against the raw request body.
5. A valid event is parsed and acknowledged. If it belongs to an issue you imported, yggy then refreshes that issue (see below).

Ping events are acknowledged and ignored. A missing or invalid signature returns 401.

What an accepted event does

An issue update, an issue deletion, or a comment on an issue is matched to the imported copies of that issue in the organization. Updates and comments re-extract the copy, a deletion moves it to the trash. Events about issues nobody imported, issue creation, and Project events are acknowledged and otherwise ignored. Only the workspace connection acts on events; a personal connection never does.

Several quick edits to one issue are folded into one refresh. A refresh uses credits like a re-extraction and waits while credits are used up. See Linear for the limits.

Use provider and API logs to diagnose registration or signature problems. yggy does not show a webhook event history in the interface; the connection’s settings page shows the last sync time and the last sync problem.

Webhook data source

The provider named Webhook on Data Sources is a different feature and is coming soon. It does not use the callback described on this page. See Webhook data source.