Document Webhook, Trigger, Core Workflow, Report Profile and Email Notification APIs

[deepblue597]

Summary

Several admin-only REST API endpoint families had no documentation on this site. This adds pages for:

• Webhook (/api/v1/webhooks) — List, Show, Create, Update
• Trigger (/api/v1/triggers) — List, Show, Create, Update
• Core Workflow (/api/v1/core_workflows) — List, Show, Create, Update
• Report Profile (/api/v1/report_profiles) — List, Create, Update, Delete
• Email Notification (/api/v1/channels_email, /api/v1/channels_email_notification, /api/v1/email_addresses) — List, Configure, and the Sender Address (EmailAddress) sub-resource

It also adds a note to the existing api/user.rst Update section: writing group_ids/role_ids is silently dropped when authenticating with an API token, but works correctly over HTTP Basic Auth.

Scope and methodology

Every payload, response body, status code, and behavioral claim in these pages comes from direct, repeated testing against a real Zammad instance (built while provisioning an internal helpdesk project). Sub-resources or actions that weren't independently exercised are intentionally omitted rather than guessed at — for example, no Delete section for Webhook/Trigger/Core Workflow, and no Show section for Report Profile, since those specific calls weren't tested.

A couple of notable, verified gotchas documented here:

• POST /api/v1/channels_email_notification requires an options key, not new_configuration (the latter matches the internal Rails service's parameter name but not the endpoint's actual contract, and fails with an unhandled error rather than a clean validation message).
• Core Workflow's condition_selected/perform does not validate that referenced ticket fields exist, while Report Profile's condition does (confirmed via a live 422 response).

Test plan

• sphinx-build -b html . _build completes cleanly with no warnings on the changed files
• Rendered pages checked locally for correct structure/formatting
• Cross-references between the new pages (and to existing pages like api/role.rst, api/sla.rst) resolve correctly

🤖 Generated with Claude Code

[deepblue597]

Hello! Thank you for waiting. Please check the documents if they follow the structure and tone of the other documents and if everything I mention is correct. If you find any issues feel free to make the necessary changes or inform me to edit them

[ralf401]

@deepblue597 Thanks again for this - great groundwork!

We'd like to get this merged. Therefore we'd like to replace the examples with ones from our internal Chrispresso stack as part of the review so they are in line with the existing API pages. So no need to rework those yourself.

Here's what we'd otherwise consider required before merging - happy to help with any of it, and we'll also try to apply fixes directly if you have maintainer edits enabled.

• api/user.rst: unclosed inline literal in the ``Authorization: Token *** sentence — the note currently renders garbled
• api/user.rst + api/email-notification.rst (Sender Address section): admin.email_address isn't an existing permission — the policy for this endpoint is admin.channel_email (with index/show also allowed for ticket.agent)
• api/object.rst: the undefined method 'match?' for nil crash is caused by a missing data_type, not data_option (a missing data_option is auto-filled server-side) — the advice to send the full record stays, the stated mechanism needs correcting
• api/user.rst note on token vs. Basic Auth: we can't confirm this from the source — please share which Zammad version you tested against, as this behavior appears version-dependent
• All pages: remove the 🤓 emoji from note bodies and the ⚠ from the danger block (repo style (new): no emoji)
• api/report-profile.rst: DELETE response body was assumed rather than captured — please either capture it or mark it as unverified
• Tone: pull the pages toward neutral reference docs (phrases like "took real trial-and-error to find", "confirmed directly, repeatedly", the per-project inventory lists)
• Add the DELETE/Show endpoints that exist but aren't documented yet on these resources

Let us know if you want to handle these points and if we are allowed to apply changes directly.

Happy hacking!

[deepblue597]

Thanks for the review! I've pushed fixes for all points:

• Permission corrected to admin.channel_email (index/show also ticket.agent); data_type named as the cause of the match? crash; emoji removed; tone neutralised; inventory lists dropped.
• Added the missing Show/DELETE endpoints (webhooks, triggers, core workflows, report profiles, email addresses), checked against routes and policies on develop.
• Token vs. Basic Auth: I couldn't reproduce it on 7.0.1, and I don't know which version the original observation came from, so I've removed the claim. What does reproduce: group_ids changes are silently ignored when the target user lacks ticket.agent (200 OK, no change), whatever the auth method.
• data_option isn't always safe to omit on update: for select it's replaced with empty defaults and the existing options are lost.
• Unclosed literal in user.rst: I couldn't reproduce the garbled rendering in a local Sphinx build. Which renderer showed it?
• Maintainer edits are enabled, so feel free to apply changes directly.

Best wishes!

[deepblue597]

Thanks for making the necessary changes on the examples.

[deepblue597]

I thought triggers would be with capital since it is an object of Zammad

[ralf401]

Yeah I think capitalizing would be an option but currently we prefer non-capitalized style for such names.

I am now waiting for internal feedback. Let's see, maybe we can merge in the next days.

[ralf401]

No objections so far, let's merge it. Thanks again!