fix: place webhook integrations on every sign-in method and fix their handlers

[jhickmanit]

Aligns the webhook-based CRM, analytics, consent, compliance, billing, SIEM, helpdesk, enrichment, and webhook infrastructure integrations with how Ory Actions run on Ory Network.

Changes

• Hook placement. After-registration and after-login actions sit in method-specific lists, such as registration.after.password.hooks followed by session. On Network the password list always contains session, so an action in the flow-wide list does not run for password sign-up. Each config aliases its password list, with YAML anchors, into the oidc, code, passkey, and webauthn lists, so the actions run for every sign-in method. can_interrupt is removed.
• Bodies and auth. Action bodies use base64://, because Ory Network rejects file://. Direct vendor calls use api_key or basic_auth, because Ory Network does not send webhook headers.
• Jsonnet. Templates are null-safe and never read metadata_admin, which the webhook context does not contain.
• Handlers that change behavior:
  • Stripe: rewritten as one asynchronous registration action, which creates the Customer with an idempotency key, plus a signed /stripe/webhook route. Each Stripe event triggers a sync of the subscription state retrieved from Stripe.
  • OneTrust: split into a parse action that returns consent metadata and an asynchronous action that records the receipt with the real identity ID.
  • Microsoft Dynamics 365: the upsert no longer sends If-Match: *, so it creates new contacts again.
  • Clearbit: writes through JSON Patch instead of replacing the identity; acknowledges after the Admin API update.
  • Segment, Splunk, Svix, and Pipedrive: acknowledge after vendor acceptance and return 502 on failure so Ory can retry without delaying user flows. Segment message IDs stay stable across retries; Splunk also checks the HEC result code.
  • Didomi and Osano: look the identity up by external_id.
  • Zendesk: detects MFA from credentials.
  • Salesforce: goes through a handler.
  • Webhook template: the template handler and its Jsonnet agree on the body shape.
• SIEM:
  • Elastic uses create for data streams and reads the IP from True-Client-Ip.
  • Sentinel uses the Logs Ingestion API.
  • Sumo Logic sets its category on the HTTP source.

Deployment notes

• Stripe serializes syncs per identity inside one process. Run one replica, or replace the lock with a distributed lock or a per-customer queue.
• The HubSpot and Zoho handlers create a new contact when a user changes their email.
• Splunk and Svix send no events for password changes.

Validation

• tsc --noEmit passes in every changed handler.
• All templates render with go-jsonnet against full, minimal, and null-trait contexts.
• Stripe was tested for reverse-order, same-second, and concurrent event delivery. OneTrust was smoke-tested.
• Nine isolated regression tests cover downstream outages, delayed acknowledgments, partial Segment retries, HEC error bodies, and Clearbit no-result responses. A GitHub Actions workflow runs them against lockfile dependencies.
• Not verified: live vendor API acceptance.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4c752992-feec-4980-b5af-2a1fb719adce

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}