> ## Documentation Index
> Fetch the complete documentation index at: https://ai-development-environment.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Configure signed GitLab project webhooks and inspect delivery history.

AIDE manages one webhook per enabled GitLab project. It subscribes to merge request, note, pipeline, job, and push events with SSL verification enabled.

<Frame>
  <img className="block dark:hidden" src="https://mintcdn.com/ai-development-environment/Qw3Fog1xz9Qqt4no/images/light/gitlab-webhooks.png?fit=max&auto=format&n=Qw3Fog1xz9Qqt4no&q=85&s=efaf76e3d35c824efda677919e3c015e" alt="GitLab webhook deliveries page in light theme" width="3840" height="2160" data-path="images/light/gitlab-webhooks.png" />

  <img className="hidden dark:block" src="https://mintcdn.com/ai-development-environment/vDVIhNqxHEltj6_h/images/dark/gitlab-webhooks.png?fit=max&auto=format&n=vDVIhNqxHEltj6_h&q=85&s=28426660cac06aed744bce4a4fc7f148" alt="GitLab webhook deliveries page in dark theme" width="3840" height="2160" data-path="images/dark/gitlab-webhooks.png" />
</Frame>

## Automatic setup

With Maintainer or Owner permission, click **Configure hook**. AIDE creates or updates its known project hook and stores a per-project signing token through the encrypted credential service.

## Manual setup

If the token cannot administer project hooks, AIDE shows:

* Callback URL: `/api/public/gitlab/webhook` on the public AIDE origin
* Merge request, note, pipeline, job, and push event checklist
* A generated signing token that can be copied once
* A reminder to keep SSL verification enabled

Create the project webhook in GitLab and paste the token. AIDE does not store a recoverable plaintext copy for later display.

## Signature validation

GitLab 19.x Standard Webhooks sign the raw request body. AIDE validates `webhook-id`, `webhook-timestamp`, and `webhook-signature`, compares the HMAC in constant time, rejects timestamps outside a five-minute window, and deduplicates delivery IDs.

The `/gitlab/webhooks` page records the event, project, action, outcome, timestamps, and sanitized error. Invalid signatures are rejected before event processing. If downstream processing fails, GitLab can redeliver the same delivery ID and AIDE retries it. A delivery is treated as a duplicate only after it reaches a processed or intentionally ignored outcome.

<Warning>
  The callback must be reachable from GitLab over HTTPS for live delivery. Polling remains available when it is not.
</Warning>