Members and webhooks

Project membership controls who can inspect or mutate one project. Outbound webhooks notify external systems about canonical project events.

Members

Open Project Settings → Members.

Permissions are evaluated against the active account, project, and environment where applicable. A member who can view a project does not automatically have permission to deploy, change variables, create databases, or delete resources.

Use the least-privilege role that supports the person's work. Remove access when it is no longer required.

Outbound webhooks

Open Project Settings → Webhooks to create an endpoint and select supported event types.

See APIs and automation for the exact event list, payload, signature construction, headers, and verification example.

Each delivery includes canonical Autodisc identities. Provider-private IDs and credentials are not public integration identifiers.

Receiver requirements

• Require HTTPS.
• Verify the Autodisc signature using the webhook secret.
• Use the delivery ID for idempotency.
• Return success quickly and process heavy work asynchronously.
• Accept duplicate and out-of-order delivery.
• Keep a bounded audit record without storing secret payload fields.

Retries

Autodisc records delivery attempts and permits authorized retries. A receiver must treat a retry as the same logical event, not a new deployment or resource request.

Rotate a webhook secret

Coordinate rotation so the receiver can temporarily accept both the old and new secret when supported. Confirm a signed test delivery, then remove the old secret.