Exports and webhooks
Exports and webhooks are delayed APIs. The job id, the file, and the callback URL each need an owner.
Tags: export, webhook, idor, jobs
Checklist
- Who can start: Roles that can create an export or register a webhook, including roles the UI hides if the API still allows them.
- Job ownership: Job id from account A, then status, cancel, and download as account B. Both accounts must be yours. Compare status and body.
- Download link: App download, email, or object storage. Note whether the link works after logout and whether it is tied to the creator.
- Row scope: Folder, org, or search filters. A filter that exists in the UI but not in the job body is the result.
- Callback target: Scheme and host rules for the webhook URL. A callback to an address you own shows delivery. Do not point it at internal networks.
- Signing secret: Header, timestamp, and where the secret is stored. Another user you control should not be able to read that secret.
- Event mix: Events from org A should not arrive at a webhook in org B. A deleted subscription should not keep receiving retries you can read.
- Delivery logs: Logs and retry bodies. They should not contain another tenant's payload or a callback URL with embedded credentials.