JIRA webhook can't make external web api call ( got Client error 403 )

[Niki W.]

We tried to trigger a webhook to call external simple web API, we've tested with curl command from our JIRA server, and successfully invoked this API call, also got 200 OK result using the curl command below:
curl -H "Content-Type: application/json" -X POST -d '{"message":"Hello"}' http://external.web.api/path

However, if we try to make this API call from webhook in JIRA, we got Client error 403 below:

httpclient-callbacks:thread-12 WARN anonymous [atlassian.webhooks.plugin.PublishTaskFactoryImpl$PublishTaskImpl] Client error - 403 when posting to web hook at 'http://external.web.api/path?user_id=xxx&user_key=xxx', body is:
{"webhookEvent":"jira:issue_created" ... }

Does anyone have the similar experience and know how to make webhook work with external web api call?  Any suggestion would be helpful, thanks in advance.  :-)

[Andy Heinzer]

The details of the curl command don't appear to show any kind of user/pass or authorization/authentication.  However your webhook seems to have a user_id and user_key fields being passed.  That isn't necessarily critical, I am not sure though how this other API service is expecting requests to be made to it, which makes this harder to troubleshoot.

And given that you are seeing an HTTP 403 error, this is an indication that the external.web.api site has authenticated the request, but is not authorizing this post command.   It is not clear to be if this is a matter of the credentials the Jira application has to try to connect there, or perhaps this other API service is denying the request for some other reason.

I think it might help to try to curl the exact same URL, content, etc to see if you can make this work that way.  

It might also help to try out a site like https://requestb.in  This site can be used to create a testing URL to create a webhook to.  That way you can try to enter this URL into Jira in a new webhook.  When that webhook then gets triggered, you can see exactly what information Jira is sending in that webhook when you visit that specific URL in your own browser.   It might not show you exactly what you want to see in regards to this API call, but it might help to understand more about how Jira is making webhooks in general.