Review the create-webhook permission limitation
Understand that the supplied create route has no explicit staff capability check.
Exact navigationDirect technical route → /ideal/create_webhook
Before you begin
- Use the exact navigation above and confirm the intended invoice, case, client, property, document or environment.
- Confirm module activation and the stated permission before attempting the action.
- Use a controlled test record for payments, emails, public/portal access, provider calls and deletion.
What this guide covers
Understand that the supplied create route has no explicit staff capability check. These instructions follow the supplied module’s live hooks, menus, controllers, forms, model rules and downstream effects.
Exact step-by-step process
- Do not expose the route to untrusted users.
- Restrict staff/session and web-server access at deployment level.
- Use settings access operationally to reach the action.
Fields, choices and supported possibilities
Implementation findingNo explicit staff_can check in create_webhook
Category/help-centre/category/stripe-ideal-payment-gateway/
Topic/help-centre/topic/stripe-ideal-webhook-management/
Code-backed validations and workflow rules
- Unlike enable_webhook, create_webhook does not call staff_can in the supplied controller.
- This is a security limitation, not an invitation to use the route without authorisation.
Expected result and verification
- Review the create-webhook permission limitation completes through the supplied module flow.
- Reopen the source record or settings page and verify the stored value, status, payment, file, timeline entry or notification.
Security, privacy and operational checks
- Use the correct Stripe test/live account and protect signing credentials.
- Do not call webhook-management routes from an untrusted session.