Webhooks

Configure webhook delivery behavior, retry handling, retention policies, and security controls in the webhooks block of the SWARM_ROOT/data/config.php file.

Alternatively, configure webhooks using the dedicated Webhooks page.

Configure webhooks

Add or edit the webhooks section in your data/config.php file:

'webhooks' => (
    'retry_schedule'              => [30, 60, 180],
    'timeout'                     => 10,
    'failure_threshold'           => 25,
    'ssrf_allowlist'              => [],
    'delivery_retention_count'    => 200,
    'rate_limit'                  => null,
    'delivery_retention_lifetime' => '30 days',
),

Webhook configuration settings

Setting Default value Description

retry_schedule

[30, 60, 180]

Specifies the delay, in seconds, between retry attempts when a webhook delivery fails. In the default configuration, P4 Code Review retries after 30 seconds, 60 seconds, and 180 seconds.

timeout

10

The maximum time, in seconds, that P4 Code Review waits for a webhook endpoint to respond before marking the delivery as failed.

failure_threshold

25

The number of consecutive failed deliveries allowed before the webhook is automatically disabled. This prevents repeated delivery attempts to an unavailable endpoint.

ssrf_allowlist

[] (empty)

A list of hosts or IP addresses that are permitted to bypass SSRF (Server-Side Request Forgery) protection checks. By default, the list is empty and standard address validation rules apply.

delivery_retention_count

200

The maximum number of delivery history records retained for each webhook. Older records are removed when the limit is exceeded.

rate_limit

null

Reserved for future rate-limiting functionality. This setting is currently stored but is not enforced by the webhook delivery pipeline.

delivery_retention_lifetime

'30 days'

The maximum age of webhook delivery history records. Records older than the specified period are removed automatically. Set this value to null or an empty string to disable age-based cleanup.

Retry behavior

The retry_schedule setting controls both:

  • The delay between retry attempts.

  • The total number of retries.

For example: 'retry_schedule' => [30, 60, 180]

P4 Code Review retries failed deliveries three times:

  • After 30 seconds.

  • After 60 seconds.

  • After 180 seconds.

Delivery history retention

P4 Code Review supports two independent retention mechanisms for webhook delivery history:

  • Count-based retention controlled by delivery_retention_count.

  • Age-based retention controlled by delivery_retention_lifetime.

Both settings can be enabled at the same time. A delivery record is removed when it exceeds either configured retention limit.

SSRF allowlist

Important: The ssrf_allowlist setting is a security control. Adding hosts or IP addresses to the allowlist permits webhook deliveries to destinations that would otherwise be blocked by SSRF protection checks. Review allowlist entries carefully before adding internal services or network addresses.

Rate limiting

The rate_limit setting is reserved for future use. Although the value is stored with the webhook configuration, it is not currently enforced by the webhook delivery process. Do not rely on this setting to throttle webhook traffic.