Webhooks: Registration API and admin management

[forrestblade]

Scope

System collection for webhook subscriptions. Register via REST API or admin panel. Each webhook targets a URL, listens to specific collection lifecycle events, and has a signing secret for payload verification.

// POST /api/_webhooks
{
  "url": "https://slack.example.com/webhook",
  "events": ["posts.afterChange", "posts.afterDelete"],
  "secret": "whsec_...",
  "active": true
}

Deliverables

1. _webhooks system collection: url, events (array), secret, active, createdAt
2. REST API at /api/_webhooks with CRUD (admin-only access)
3. Event format: {collection}.{hookName} — e.g., posts.afterChange, users.afterDelete
4. Wildcard support: posts.* subscribes to all post events, *.afterChange subscribes to all changes
5. Admin UI: webhook management page — create, edit, toggle active, delete
6. Secret generation helper: valence webhook:secret CLI command
7. Tests: CRUD operations, event format validation, wildcard matching, admin UI rendering

[linear]

VAL-296