Review the create-webhook permission limitation
Pixie CRM guidance. Follow the route for your workspace, check your role and enabled modules, and verify the result before moving on.
This guide explains that the supplied create route has no explicit staff capability check.
Where to goDirect technical route → /ideal/create_webhook
Before you start
- Use the exact navigation above and confirm the intended invoice, case, client, property, document or environment.
- Verify module activation and the stated permission before attempting the action.
- Use a controlled test record for payments, emails, public/portal access, provider calls and deletion.
What this guide helps you do
Understand that the supplied create route has no explicit staff capability check. These instructions follow the supplied module’s live hooks, menus, controllers, forms, model rules and downstream effects.
Follow these steps
- Do not expose the route to untrusted users.
- Restrict staff/session and web-server access at deployment level.
- Use settings access operationally to reach the action.
Fields and options
Implementation findingNo explicit staff_can check in create_webhook
Category/help-centre/category/stripe-ideal-payment-gateway/
Topic/help-centre/topic/stripe-ideal-webhook-management/
Rules and limits
- Unlike enable_webhook, create_webhook does not call staff_can in the supplied controller.
- This is a security limitation, not an invitation to use the route without authorisation.
Check it worked
- Check the create-webhook permission limitation completes through the supplied module flow.
- Reopen the source record or settings page and verify the stored value, status, payment, file, timeline entry or notification.
Security, privacy and operational checks
- Use the correct Stripe test/live account and protect signing credentials.
- Do not call webhook-management routes from an untrusted session.
Related guides
Was this guide useful?Your response is stored only in this browser.