opschain admin jsm-connections provision-webhook
integrations:jira-service-management
Provisions Jira webhook ingestion for a connection: one signed
inbound-webhook connection on the generic inbound lane — deliveries
POST to /api/hooks/jsm-<code>, authenticated by an HMAC signature,
deduplicated, and executed (when a trigger matches) as the named
service account. Request created/updated/commented events additionally
expose a normalised typed field set under event.data.jira (key,
project, status, summary, priority, labels…) for trigger conditions;
the raw payload stays under event.data.payload.
Jira Data Center signs natively: configure the webhook secret and Jira
sends X-Hub-Signature (sha256 HMAC), which the lane honours. An
unsigned source must be fronted by a signer that adds the generic
X-OpsChain-Signature + timestamp shape. An omitted signing secret is
generated and shown exactly once.
opschain admin jsm-connections provision-webhook limepoint-jsm --service-account jsm-bot
Provisioned Jira webhook ingestion for limepoint-jsm as inbound connection jsm-limepoint-jsm
Point the Jira webhook at <server URL>/api/hooks/jsm-limepoint-jsm
Signing secret (shown ONCE - configure it as the Jira webhook secret): 3f9c…
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
--service-account <name> | The service account every trigger firing a delivery causes executes as (required). |
--secret-env <name> | Environment variable holding the webhook signing secret (omit to have one generated). |
--secret-prompt | Prompt for the webhook signing secret without echo. |
--replay-window <seconds> | Replay window, 30–86400 (0: 300, the lane default). |
--rate-per-minute <n> | Per-minute request budget: 1–6000 for the connection's own budget, 0 (the default) inherits the estate default webhooks.default_rate_per_minute (itself unset = 60), -1 is unlimited at this connection (pass it as --rate-per-minute=-1). |
See also
opschain docs cli/admin-inbound-webhooks— managing the provisioned connection directly.opschain docs triggers— pointing a trigger atexternal:webhook:received.