How should an admin-created Jira webhook be authenticated?

Configure a high-entropy secret on the webhook, store it on the receiver, and verify the HMAC value in `X-Hub-Signature` against the raw request body.

Why can the same Jira webhook arrive more than once?

Jira retries connection failures and specific response codes. Use `X-Atlassian-Webhook-Identifier`, which stays constant across retries, to make processing idempotent.

Why did a dynamic Jira webhook stop delivering?

A webhook registered through the REST API expires after 30 days unless the app extends it. Check its registration and renewal before changing firewall rules.

Can robots.txt block Jira webhooks?

No. Jira posts to a callback URL that was explicitly registered. Remove the registration, disable the receiving route, or use access controls if delivery should stop.

Do Jira webhooks affect AI search or training?

No. They carry Jira event data between configured systems and do not crawl public web content for search or model development.

Atlassian Jira Webhooks Bot Guide

What is Atlassian Jira Webhooks?

Jira Cloud webhooks send HTTP callbacks when a subscribed Jira event occurs. An administrator can create a webhook in Jira, an Atlassian Connect app can declare one in its descriptor, and eligible apps can register dynamic webhooks through the REST API. The callback contains event data for the matching issues or other Jira resources, subject to the webhook's event and JQL filters.

Authentication depends on how the webhook was registered. Admin and REST webhooks can be configured with a secret that Jira uses to create an HMAC signature in X-Hub-Signature. Connect webhooks are signed with the app's shared secret, while OAuth 2.0 app webhooks carry a signed bearer token in the Authorization header. A Jira-looking user agent is not a substitute for the applicable signature or token check.

Jira retries selected failures, including connection errors and responses such as 429 or 5xx. X-Atlassian-Webhook-Identifier remains the same across retries, which gives receivers a stable value for duplicate detection. Dynamic webhooks registered through the REST API expire after 30 days unless the app extends their life.

These requests deliver Jira events to an endpoint chosen by an administrator or app. The workflow does not inspect public pages and contributes nothing to AI search or model training. Robots.txt has no role because Jira is calling a configured callback URL rather than crawling the site.

Not relevant for AI search

Is Atlassian Jira Webhooks relevant for AI search?

No. Atlassian Jira Webhooks is not part of AI search or training, so allowing or blocking it does not change your AI visibility.

Atlassian Jira Webhooks is not a crawler. It delivers webhook notifications to endpoints you registered, so it never fetches public content for an AI product. Robots.txt does not apply, and allowing or blocking it has no effect on AI search or training.

How to handle Atlassian Jira Webhooks

Keep the callback reachable when a Jira integration depends on it, but require the authentication method configured for that webhook. For an admin or REST webhook with a secret, calculate the documented HMAC over the raw UTF-8 body and compare it with X-Hub-Signature. Validate the signed bearer token for an OAuth 2.0 webhook, or use the Atlassian framework's JWT verification for a Connect app.

Record X-Atlassian-Webhook-Identifier before applying changes so a retried delivery cannot repeat the same side effect. Return 200 after the event has been accepted. An invalid signature, token, or payload should be rejected without running the Jira-triggered action.

If the integration has been retired, delete its Jira webhook registration and close the callback route. A firewall can reject traffic to that route, but user-agent matching and robots.txt do not authenticate or control Jira webhook delivery.

Examples

An issue transition matches a webhook's JQL filter, and Jira posts the change to an internal deployment service.
A receiver verifies the `X-Hub-Signature` created with its admin webhook secret before updating a support record.
Jira retries a timed-out callback with the same `X-Atlassian-Webhook-Identifier`, so the endpoint recognizes that the event was already applied.

Frequently asked questions about Atlassian Jira Webhooks

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

The registration selects event types and can use JQL to limit matching issues. Jira can send events for issue activity and other supported Jira resources.