WebhookUrlPolicy

Enforce HTTPS scheme for absolute URLs; reject http:// when true.

Hostname allowlist. Supports exact hosts and wildcard subdomains.

Use entries like "hooks.example.com" or "*.mycorp.com". The wildcard only matches subdomains ("foo.mycorp.com"), not the apex ("mycorp.com"). When empty or omitted, any public host is allowed (subject to SSRF IP checks).

Explicit port allowlist for absolute URLs.

If set, requests must use one of these ports. Defaults are respected when a port is not present in the URL (443 for https, 80 for http).

Maximum permitted URL length in characters; longer inputs are rejected early.

Disallow relative URLs (internal loopback calls) when true.