Skip to main content

Developers

Fixed source defines a Developers view under Settings → Pro for the level-0 route and Pro/Enterprise group gate, with Plugins, Webhooks, and API Keys cards.

Developers overview with Plugins, Webhooks, and API Keys cards

Source-defined cards and query state​

The Developers view defines three cards—Plugins, Webhooks, and API Keys—and represents the selected card in ?category=developers&id=:id. Only the Ordering developers tab is enabled in the fixed source.

The Webhooks controller mounts with an authenticated collection read. Its UI can stage URL, trigger, and delay data; Add webhook maps to a collection POST and confirmed deletion maps to an item DELETE. The API also declares update and manual-dispatch routes, but this UI does not expose manual dispatch.

Webhook delivery boundary

A webhook record contains a destination and event selection capable of outbound delivery. No webhook list, destination, event payload, redirect URI, request, or provider was read or exercised.

API keys​

The API Keys controller reads /users/{user}/keys only for source levels 0 or 2. The UI renders returned key values and exposes clipboard copy, immediate collection POST, and confirmed item DELETE paths. These mechanics do not prove a current key, its scope, validity, creation, revocation, or authorization.

Secrets

No key list was loaded and no key was displayed, copied, created, or deleted. Keys, tokens, headers, URLs, user identifiers, and provider responses remain excluded from evidence.

Plugins​

Plugins open a project-specific management sidebar backed by a plugin list. Fixed source does not establish returned plugins, settings, credentials, provider effects, install state, or deployed behavior.

Source-only boundaries​

  • /all-settings is level-0 routed; the Pro group requires Pro or Enterprise, while the API-key controller separately contains a 0-or-2 read condition that does not widen route access.
  • Fixed API source declares webhook, user-key, and plugin contracts; verbs and routes are not deployed authorization, delivery, key validity, revocation, provider, or success evidence.
  • Re-entry requires an immutable serving receipt plus credential-free synthetic fixtures with webhook/key/plugin reads and writes intercepted and outbound egress denied.

Related guides: Integrations (analytics and live chat) · Settings logs · Settings overview