On This Page

Enhanced Webhook URL Review and Approval Process

We have introduced an enhancement to webhook subscription processing to improve security, compliance, and visibility for webhook-related URLs. Webhook URLs are now validated and reviewed before they can be used. This includes both newly submitted subscriptions and existing subscriptions currently on file.

What is Changing

When a webhook subscription is created or updated, the URLs associated with that subscription are evaluated through a validation and approval process.

This applies to:

Webhook URL
(required)

OAuth URL
(if applicable)

Health Check URL
(if applicable)

As part of this enhancement, clients might now see the following user-facing statuses:

PENDING_REVIEW

BLOCKED

The existing INACTIVE
status remains unchanged and continues to indicate that the subscription is approved and ready within the current lifecycle.

Status Descriptions

Status	Description
PENDING_REVIEW	One or more submitted URLs are being validated or awaiting required security approval.
BLOCKED	One or more URLs were rejected or identified as unsafe or non-compliant. The subscription cannot proceed until the URL(s) are updated.
INACTIVE	All required approvals are complete, and the subscription is ready under the existing activation flow.

How the New Process Works

A webhook subscription is created or updated.

Submitted URLs are checked against existing approval records.

New or unknown URLs are evaluated through automated validation.

If additional review is required, the subscription status changes to PENDING_REVIEW
.

If any URL is rejected or blocked, the subscription status changes to BLOCKED
.

If all required URLs are approved, the subscription status changes to INACTIVE
.

In cases where a subscription status is change to BLOCKED
, clients are expected to perform these tasks:

Review the affected endpoint(s).

Update the URL(s) to an acceptable endpoint.

Resubmit the subscription for processing.

For New Subscriptions

New webhook-related URLs may go through validation and, if necessary, security review before the subscription can proceed.

Why We Are Making This Change

This enhancement is designed to:

Reduce security risk
by preventing outbound calls to unapproved endpoints.

Improve compliance
through stronger review and approval controls.

Increase transparency
with clearer client-visible statuses.

Support scale
through a standardized and repeatable validation process.