Review the create-webhook permission limitation
This guide explains that the supplied create route has no explicit staff capability check. The guide then takes you through the correct route, the checks to complete before making changes, the workflow in order, and the evidence to review afterwards.
Where to goDirect technical route → /ideal/create_webhook
Before you start
- Use the exact navigation above and confirm the intended invoice, case, client, property, document or environment.
- Verify module activation and the stated permission before attempting the action.
- Use a controlled test record for payments, emails, public/portal access, provider calls and deletion.
What you’ll accomplish
Understand that the supplied create route has no explicit staff capability check. These instructions follow the supplied module’s live hooks, menus, controllers, forms, model rules and downstream effects.
Follow these steps
- Do not expose the route to untrusted users.
- Restrict staff/session and web-server access at deployment level.
- Use settings access operationally to reach the action.
Fields and options to review
Implementation findingNo explicit staff_can check in create_webhook
Category/help-centre/category/stripe-ideal-payment-gateway/
Topic/help-centre/topic/stripe-ideal-webhook-management/
Rules the system enforces
- Unlike enable_webhook, create_webhook does not call staff_can in the supplied controller.
- This is a security limitation, not an invitation to use the route without authorisation.
How to confirm it worked
- Check the create-webhook permission limitation completes through the supplied module flow.
- Reopen the source record or settings page and verify the stored value, status, payment, file, timeline entry or notification.
Security, privacy and operational checks
- Use the correct Stripe test/live account and protect signing credentials.
- Do not call webhook-management routes from an untrusted session.
Continue with related guidance
Was this guide useful?Your response is stored only in this browser.