Bot Webhook not triggering

[j5bart]

Tip

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1. Setup a webhook test endpoint
   • I used a simple Python Flask app on my local machine at: http://<my local ip>:5000/webhook
2. Install bot using occ enabling (all?) features
   • I ran occ talk:bot:install --feature reaction --feature response --feature event --feature webhook webhooktest <my secret> "http://<my local ip>:5000/webhook" "Webhook test"
   • Verified bot successfully installed with occ talk:bot:list:

+----+--------------------+-----------------------------------------+-------------+-------+------------------------------------+
| id | name               | description                             | error_count | state | features                           |
+----+--------------------+-----------------------------------------+-------------+-------+------------------------------------+
...
| 7  | webhooktest        | Webhook test                            | 0           | 1     | webhook, response, event, reaction |
+----+--------------------+-----------------------------------------+-------------+-------+------------------------------------+

3. Enabled bot in Talk Room
4. Sent messages in room

Expected behaviour

POST sent to webhook http://<my local ip>:5000/webhook

Actual behaviour

No log of any POST sent to webhook

A manual curl test from server works fine:
curl -X POST http://<my local ip>:5000/webhook -d test
responding with expected:

{
  "error": "Invalid signature"
}

and log of:
<server ip> - - [27/Mar/2026 11:42:14] "POST /webhook HTTP/1.1" 403 -
from Flask app.

Talk app

Talk app version: 22.0.10

Custom Signaling server configured: no

Custom TURN server configured: no

Custom STUN server configured: no

Browser

Microphone available: no

Camera available: no

Operating system: Windows

Browser name: Edge

Browser version: 146.0.3856.78

Browser log

Will provide if you think relevant.

Server configuration

Operating system: Ubuntu

Web server: Nginx

Database: PostgreSQL

PHP version: 8.3

Nextcloud Version: 32.0.6

List of activated apps:

Details

Enabled:
  - activity: 5.0.0
  - admin_audit: 1.22.0
  - announcementcenter: 7.3.0
  - app_api: 32.0.0
  - assistant: 2.12.0
  - bruteforcesettings: 5.0.0
  - calendar: 6.2.0
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contacts: 8.3.2
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2
  - drawio: 3.1.2
  - encryption: 2.20.0
  - external: 7.0.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_external: 1.24.1
  - files_pdfviewer: 5.0.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0
  - integration_homeassistant: 0.0.7
  - integration_openai: 3.10.0
  - keeweb: 0.6.22
  - logreader: 5.0.0
  - lookup_server_connector: 1.20.0
  - mail: 5.7.5
  - memories: 7.8.2
  - music: 3.0.0
  - nextcloud_announcements: 4.0.0
  - notes: 4.13.0
  - notifications: 5.0.0
  - oauth2: 1.20.0
  - oidc: 1.15.0
  - onlyoffice: 9.12.0
  - password_policy: 4.0.0
  - phonetrack: 0.9.1
  - photos: 5.0.0
  - previewgenerator: 5.13.0
  - privacy: 4.0.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recognize: 10.0.7
  - recommendations: 5.0.0
  - related_resources: 3.0.0
  - richdocuments: 9.0.2
  - richdocumentscode: 25.4.901
  - serverinfo: 4.0.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - spreed: 22.0.10
  - support: 4.0.0
  - survey_client: 4.0.0
  - suspicious_login: 10.0.0
  - systemtags: 1.22.0
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - twofactor_nextcloud_notification: 6.0.0
  - twofactor_totp: 14.0.0
  - updatenotification: 1.22.0
  - user_saml: 7.1.4
  - user_status: 1.12.0
  - viewer: 5.0.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - files_videoplayer: 1.13.0
  - occweb: 0.2.3 (installed 0.2.3)
  - ocsms: 2.2.0 (installed 2.2.0)
  - user_ldap: 1.23.0

Nextcloud configuration:

Details

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/nextcloud.jsbart.com",
        "dbtype": "pgsql",
        "version": "32.0.6.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "theme": "",
        "loglevel": 0,
        "mail_smtpmode": "smtp",
        "mail_smtpauthtype": "LOGIN",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpdebug": true,
        "mail_sendmailmode": "smtp",
        "mail_smtpport": "465",
        "mail_smtpsecure": "tls",
        "filelocking.enabled": true,
        "default_phone_region": "GB",
        "memories.exiftool": "\/storage\/srv\/nextcloud\/www-nginx\/apps\/memories\/bin-ext\/exiftool-amd64-glibc",
        "memories.vod.path": "\/storage\/srv\/nextcloud\/www-nginx\/apps\/memories\/bin-ext\/go-vod-amd64",
        "memories.db.triggers.fcu": true,
        "memories.vod.disable": false,
        "memories.gis_type": 2,
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe"
    }
}

Server log (data/nextcloud.log)

Details

Very large (81MB)... no relevant warnings or errors I could see. Advise if anything in particular want me to look for.

[SystemKeeper]

This should generally work fine, but since you test locally, can try setting the following:
https://github.com/nextcloud/server/blob/f8cc0adefb0703bc5d816b328f2c1d97a40f7e04/config/config.sample.php#L823-L828

?

[nickvergessen]

Should be overruled already by

spreed/lib/Service/BotService.php

Lines 368 to 371 in 9e60e3e

	'verify' => $this->certificateManager->getAbsoluteBundlePath(),
	'nextcloud' => [
	'allow_local_address' => true,
	],

But that makes me wonder, verify is not false, so it basically does not allow http:// but only https:// ?

[SystemKeeper]

A good point, let me try to double check on my end. I think I used https to test.

[j5bart]

Should be overruled already by

spreed/lib/Service/BotService.php

Lines 368 to 371 in 9e60e3e

'verify' => $this->certificateManager->getAbsoluteBundlePath(),
'nextcloud' => [
'allow_local_address' => true,
],
But that makes me wonder, verify is not false, so it basically does not allow http:// but only https:// ?

I did try to add the config but has not made a difference. Thanks for the suggestion though @SystemKeeper .

Regarding HTTP vs HTTPS that could be a promising lead and valid root cause here - I'll see if I can setup an HTTPS endpoint to verify against.

[SystemKeeper]

Regarding HTTP vs HTTPS that could be a promising lead and valid root cause here - I'll see if I can setup an HTTPS endpoint to verify against.

If you use a self-signed certificate, you can import it via occ security:certificates:import

[nickvergessen]

Regarding HTTP vs HTTPS that could be a promising lead and valid root cause here - I'll see if I can setup an HTTPS endpoint to verify against.

You can try to replace the line I linked with 'verify' => false, and see if it then works?

[j5bart]

Unfortunately I'm still having same issue when installing new bot using https:// instead of http:// and enabling it in the Room.

Also tried updating apps/spreed/lib/Service/BotService.php:

                $data = [
//                      'verify' => $this->certificateManager->getAbsoluteBundlePath(),
                        'verify' => false,
                        'nextcloud' => [
                                'allow_local_address' => true,
                        ],
                        'headers' => $headers,
                        'timeout' => 5,
                        'body' => $jsonBody,
                ];

but again no luck.

[j5bart]

After looking at source code and adding some additional trace debugging I found this wasn't working due to the event feature being on.
This is working better if I remove --feature event argument from occ talk:bot:install.
I can now see POST submitted successfully to my test webhook endpoint via both http:// and https://.

Is this to be expected?
From reading https://nextcloud-talk.readthedocs.io/en/latest/occ/#usage it wasn't clear this was an expected impact to webhook.
To be honest I also did not fully understand what --feature event is suppose to be providing - I thought it would POST more frequently triggered by events occurring with a Room (eg. user being added etc.)?

[SystemKeeper]

Great find! Indeed we handle that separately at

spreed/lib/Service/BotService.php

Line 251 in 9e60e3e

if ($bot->getFeatures() & Bot::FEATURE_EVENT) {

. And while we strip the webhook in case of event (

spreed/lib/Command/Bot/Install.php

Line 87 in 3706e1e

$featureFlags &= ~Bot::FEATURE_WEBHOOK;

), we don't do the opposite.

To be honest I also did not fully understand what --feature event is suppose to be providing - I thought it would POST more frequently triggered by events occurring with a Room (eg. user being added etc.)?

No, you can either receive a webhook (via POST), or a dispatched event that will be handled by a Nextcloud (bot) app. So that is exactly what is happening here, your bot dispatches a local event (since --event is configured) and not an actual webhook (although that is specified).
Thanks for investigating, we are going to take a look.