Global events types are part of the Tenant API

[jthn]

Global events types are part of the Tenant API

Description

Currently, the following events are allowed in the request when using the Tenant API:

audit-log.create
event-log.create
kickstart.success

These event types are not configurable in the context of a tenant in the UI, and are only configurable when creating a webhook in Settings > Webhooks, or through the webhook API.

While it is possible to enable those events for a webhook that is applied to a tenant, they are flagged as being system events, which makes sense. I.e., I expect to be able to define a webhook endpoint, enable global events along with Tenant level events, and apply that webhook to one or more tenants.

The issue pops up when interacting with those events through the tenant API.

When making a POST/PUT/PATCH to the tenant API, it returns a 400 error if you provide events that are not defined in the tenant API (expected), however, you can still provide the system level events to the tenant API, and it accepts them. The response from the tenant API does not include the provided events as they aren't applicable in the context of the tenant.

I tend to think that these events should not be a part of the tenant API at all, and the tenant API should issue a 400 if you try to provide them there. Additionally, these events are defined as part of the tenant API in the docs, however, as they have no impact to the tenant, it might make sense to remove them from the events section on the tenant entirely, and only allow them to be configured in the webhook API.

[robotdan]

Thanks for reporting this @jthn.

I think you're correct, it would be better to a 400 with a validation error.