feat(reports): add webhook option for notifications by sjingoi · Pull Request #36127 · apache/superset

sjingoi · 2025-11-16T04:14:10Z

User description

SUMMARY

Added a webhook option for notification method when creating alerts/reports.
Created a new class for webhooks to follow the same pattern as the existing email and slack options

The webhook provides the following information in a request:

Name
Text
Description
Content header
Dashboard url

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

Testing webhook feature:

Set up alerts and reports as outlined in https://superset.apache.org/docs/configuration/alerts-reports
Add a new feature flag "ALERT_REPORT_WEBHOOK": True in superset_config.py
Start superset and go to alerts and reports
Create an alert / report. Set the notification type to webhook.
Enter a webhook url. This can be your own application or anything that accepts webhook such as https://webhook.site/
Wait for the report or alert trigger. When this happens, check to make sure that the application receives all of the relevant data (images, files, headers, etc.)

Testing webhook flag:

Change the feature flag to "ALERT_REPORT_WEBHOOK": False
It should no longer be possible to create new webhook reports
Existing webhook reports will error with a message saying "Attempted to send a Webhook notification but Webhook feature flag is not enabled."

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

CodeAnt-AI Description

Add Webhook notification method for alerts and reports

What Changed

Users can choose "Webhook" as a notification method in Alerts & Reports (when the ALERT_REPORT_WEBHOOK feature flag is enabled); the UI shows a required webhook URL input instead of recipient/channel inputs and displays a webhook icon.
Backend sends POST requests to the configured webhook target containing report metadata (name, text, description, url) and a header with notification details.
Report attachments (CSV, PDF, screenshots) are uploaded as multipart files when present; otherwise the payload is sent as JSON.
New configuration and safety checks: a feature flag ALERT_REPORT_WEBHOOK (default off) controls availability, and ALERT_REPORTS_WEBHOOK_HTTPS_ONLY (default true) enforces HTTPS and rejects non-HTTPS webhook URLs.
Network and server errors are handled: 5xx and 429 responses trigger retry behavior; 4xx responses are reported as parameter errors; attempting to send when the feature flag is off raises an error.
Unit tests added to validate webhook URL parsing, payload structure, file attachments, and HTTPS enforcement.

Impact

✅ Send alerts/reports to webhook endpoints
✅ Include report files and screenshots in webhook requests
✅ Reject non-HTTPS webhook URLs when HTTPS-only config is enabled

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

korbit-ai · 2025-11-16T04:14:14Z

Based on your review schedule, I'll hold off on reviewing this PR until it's marked as ready for review. If you'd like me to take a look now, comment /korbit-review.

Your admin can change your review schedule in the Korbit Console

rusackas · 2025-11-24T18:30:34Z

  AlertReports = 'ALERT_REPORTS',
  AlertReportTabs = 'ALERT_REPORT_TABS',
  AlertReportSlackV2 = 'ALERT_REPORT_SLACK_V2',
+  AlertReportWebhook = 'ALERT_REPORT_WEBHOOK',


I'm not sure we need this feature flag. I think this won't really break anything for existing users, and only ads new tooling for users.

In fairiness, we should probably open another PR to remove ALERT_REPORT_SLACK_V2 soon and complete that migration. And probably several others 😅

Someone in the slack chat suggested that I add this to make it similar to how slack notifications are disabled by default and only enabled when a slack API key is provided. I dont mind removing it though since i agree i also dont really see how it breaks anything. Let me know what you think!

Gentle ping @rusackas 😄

sfirke · 2025-12-02T15:17:49Z

This is exciting! I'll just add that I believe this would allow for Superset to send messages in Microsoft Teams, which is something my org would use.

rusackas · 2025-12-17T18:08:23Z

I think we've resolved all but one bot-discovered issue here, and we just have some pre-commit/CI issues to tend to.

If you can patch this up a bit (or allow me to write to your fork/branch/pr) I think we can get this one through!

sjingoi · 2025-12-17T18:21:21Z

@rusackas Ill patch it up tonight with my teammate. Thanks for the feedback its been really helpful :D

Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>

sjingoi · 2025-12-18T01:27:20Z

+        except (json.JSONDecodeError, KeyError, TypeError) as ex:
+            raise NotificationParamException("Webhook URL is required") from ex
+
+    def _get_req_payload(self) -> dict[str, Any]:


i just want to highlight that the selection of this structure for the json payload was kind of arbitrary. Is there any particular structure we want to format this in or are we good with the way it is?

AlwaysIngame · 2025-12-19T00:27:46Z

Checks passing, looks like we're good to go?

rusackas · 2025-12-23T18:50:46Z

This is awesome! Let's merge this sucker! THANK YOU!

…d config - security.mdx: document API key authentication (PR #37973) — creation via Security → API Keys, Bearer token usage, use cases, and security caution - alerts-reports.mdx: document webhook notifications (PR #36127) — enable via ALERT_REPORT_WEBHOOK feature flag, JSON payload format, multipart attachments, HTTPS enforcement, and retry behavior - theming.mdx: update default fonts note (IBM Plex Mono replaces Fira Code as default monospace in 6.1); add Theme Validation and Fallback section explaining the three-level fallback order and warning log behavior - configuring-superset.mdx: document HASH_ALGORITHM config key (md5/sha256 for FedRAMP compliance) and SQLLAB_HISTORY_RETENTION_DAYS (default 30 days, None to disable pruning) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-authored-by: Hriday Algh <hridayalgh@gmail.com> Co-authored-by: Hriday Algh <53922405+AlwaysIngame@users.noreply.github.com> Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>

sjingoi added 3 commits November 15, 2025 21:48

added empty webhook option to frontend for alerts and reports

733ef31

added url field to webhook on frontend

b7a7914

added starter webhook class

d51af86

pull-request-size Bot added the size/L label Nov 16, 2025

sjingoi changed the title ~~Webhook~~ feat(alerts and reports): add webhook option for notifications Nov 16, 2025

basic non-file info sent to webhook url

1494a81

sjingoi changed the title ~~feat(alerts and reports): add webhook option for notifications~~ feat(reports): add webhook option for notifications Nov 17, 2025

sadpandajoe added review:draft review:checkpoint Last PR reviewed during the daily review standup and removed review:checkpoint Last PR reviewed during the daily review standup labels Nov 17, 2025

AlwaysIngame added 2 commits November 20, 2025 21:03

feat: Add icon for Webhook notification method

c8064a8

feat: Add sending of data to webhook notification

f9e9f6e

github-actions Bot added the packages label Nov 21, 2025

sjingoi and others added 2 commits November 23, 2025 12:52

added webhook feature flag

8b13ade

Webhook: Add HTTPS enforcement via config

80880d8

sjingoi marked this pull request as ready for review November 24, 2025 17:17

dosubot Bot added alert-reports Namespace | Anything related to the Alert & Reports feature change:frontend Requires changing the frontend labels Nov 24, 2025

rusackas removed the review:draft label Nov 24, 2025

rusackas reviewed Nov 24, 2025

View reviewed changes

Comment thread superset/config.py Outdated

rusackas reviewed Nov 24, 2025

View reviewed changes

rusackas added the 🎪 ⚡ showtime-trigger-start Create new ephemeral environment for this PR label Nov 24, 2025

rusackas requested review from eschutho and msyavuz November 24, 2025 18:30

github-actions Bot added 🎪 80880d8 🚦 building and removed 🎪 ⚡ showtime-trigger-start Create new ephemeral environment for this PR labels Nov 24, 2025

github-actions Bot removed 🎪 80880d8 ⌛ 48h labels Nov 27, 2025

sjingoi added 2 commits November 30, 2025 15:16

added webhook url tests

1d40911

more webhook notification tests

7c14cbb

pull-request-size Bot added size/XL and removed size/L labels Nov 30, 2025

Merge branch 'apache:master' into webhook

f4deefb

codeant-ai-for-open-source Bot added the size:L This PR changes 100-499 lines, ignoring generated files label Dec 4, 2025

codeant-ai-for-open-source Bot reviewed Dec 4, 2025

View reviewed changes

apache deleted a comment from codeant-ai-for-open-source Bot Dec 17, 2025

AlwaysIngame and others added 3 commits December 17, 2025 19:04

Formatting

26cede2

Update superset/reports/notifications/webhook.py

363194e

Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>

Merge branch 'apache:master' into webhook

8fd4a7c

sjingoi commented Dec 18, 2025

View reviewed changes

apache deleted a comment from codeant-ai-for-open-source Bot Dec 18, 2025

rusackas approved these changes Dec 23, 2025

View reviewed changes

rusackas merged commit f8cb935 into apache:master Dec 23, 2025
69 checks passed

This was referenced Mar 4, 2026

webhook notifications https error #38379

Closed

Webhook notification fails with 413 (Request body too large) and 400 (multipart decode error) when sending PDF/PNG reports to Mattermost #38420

Closed

rusackas mentioned this pull request Apr 17, 2026

docs: Superset 6.1 documentation catch-up (security, alerts/reports, theming, config) #39440

Merged

6 tasks

Conversation

sjingoi commented Nov 16, 2025 • edited by codeant-ai-for-open-source Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

CodeAnt-AI Description

What Changed

Impact

Checking Your Pull Request

Talking to CodeAnt AI

Example

Preserve Org Learnings with CodeAnt

Example

Retrigger review

Check Your Repository Health

Uh oh!

korbit-ai Bot commented Nov 16, 2025

Uh oh!

Uh oh!

rusackas Nov 24, 2025

Choose a reason for hiding this comment

Uh oh!

sjingoi Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

sjingoi Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

sfirke commented Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rusackas commented Dec 17, 2025

Uh oh!

sjingoi commented Dec 17, 2025

Uh oh!

sjingoi Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

AlwaysIngame commented Dec 19, 2025

Uh oh!

rusackas commented Dec 23, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sjingoi commented Nov 16, 2025 •

edited by codeant-ai-for-open-source Bot

Loading