snapshot of https://github.com/espocrm/espocrm.git (master, 2026-09-18; blobs > 131072B omitted)

application/Espo/Core/Webhook/AddressUtil.php

@@ -0,0 +1,54 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Webhook;
+
+use Espo\Core\HttpClient\Util;
+use Espo\Core\Utils\Config;
+
+/**
+ * @internal
+ */
+class AddressUtil
+{
+    public function __construct(
+        private Config $config,
+    ) {}
+
+    /**
+     * @internal
+     */
+    public function isAllowedUrl(string $url): bool
+    {
+        /** @var string[] $allowedAddressList */
+        $allowedAddressList = $this->config->get('webhookAllowedAddressList') ?? [];
+
+        return Util::matchUrlToAddressList($url, $allowedAddressList);
+    }
+}

application/Espo/Core/Webhook/Events/UpdateGlobal.php

@@ -0,0 +1,46 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Webhook\Events;
+
+use Espo\Core\Utils\Event\CrossInstanceEvent;
+use stdClass;
+
+class UpdateGlobal implements CrossInstanceEvent
+{
+    public static function fromPayload(stdClass $payload): CrossInstanceEvent
+    {
+        return new self();
+    }
+
+    public function toPayload(): stdClass
+    {
+        return (object) [];
+    }
+}

application/Espo/Core/Webhook/Manager.php

@@ -0,0 +1,331 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Webhook;
+
+use Espo\Core\Name\Field;
+use Espo\Core\ORM\Entity;
+use Espo\Core\ORM\EntityManager;
+use Espo\Core\Utils\Cache\DataCacheAccess;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Event\Context;
+use Espo\Core\Utils\Event\EventDispatcher;
+use Espo\Core\Utils\FieldUtil;
+use Espo\Core\Utils\Log;
+use Espo\Core\Webhook\Events\UpdateGlobal;
+use Espo\Entities\Webhook;
+use Espo\Entities\WebhookEventQueueItem;
+use Espo\ORM\Name\Attribute;
+use stdClass;
+
+/**
+ * Processes events. Holds an information about existing events.
+ */
+class Manager
+{
+    private string $cacheKey = 'webhooks';
+
+    /** @var string[] */
+    protected $skipAttributeList = [
+        Field::IS_FOLLOWED,
+        Field::IS_STARRED,
+        Field::FOLLOWERS . 'Ids',
+        Field::FOLLOWERS . 'Names',
+        Field::MODIFIED_AT,
+        Field::MODIFIED_BY,
+        Field::STREAM_UPDATED_AT,
+        Field::VERSION_NUMBER,
+    ];
+
+    /**
+     * @param DataCacheAccess<array<string, bool>> $dataCacheAccess
+     */
+    public function __construct(
+        private Config $config,
+        private EntityManager $entityManager,
+        private FieldUtil $fieldUtil,
+        private Log $log,
+        private DataCacheAccess $dataCacheAccess,
+        private EventDispatcher $eventDispatcher,
+    ) {
+
+        $this->dataCacheAccess->init(
+            key: $this->cacheKey,
+            loader: fn () => $this->buildData(),
+        );
+
+        $this->eventDispatcher->subscribe(UpdateGlobal::class, function (UpdateGlobal $event, Context $context) {
+            if ($context->isLocal) {
+                return;
+            }
+
+            $this->dataCacheAccess->reset();
+        });
+    }
+
+    /**
+     * @return array<string, bool>
+     */
+    private function buildData(): array
+    {
+        $data = [];
+
+        $list = $this->entityManager
+            ->getRDBRepositoryByClass(Webhook::class)
+            ->select(['event'])
+            ->group(['event'])
+            ->where([
+                'isActive' => true,
+                'event!=' => null,
+            ])
+            ->find();
+
+        foreach ($list as $webhook) {
+            $event = $webhook->getEvent();
+
+            $data[$event] = true;
+        }
+
+        return $data;
+    }
+
+    /**
+     * Add an event. To cache the information that at least one webhook for this event exists.
+     */
+    public function addEvent(string $event): void
+    {
+        $data = $this->dataCacheAccess->get();
+
+        $data[$event] = true;
+
+        $this->dataCacheAccess->set($data);
+        $this->dataCacheAccess->store();
+
+        $this->eventDispatcher->dispatch(new UpdateGlobal());
+    }
+
+    /**
+     * Remove an event. If no webhooks with this event left, then it will be removed from the cache.
+     */
+    public function removeEvent(string $event): void
+    {
+        $one = !$this->entityManager
+            ->getRDBRepositoryByClass(Webhook::class)
+            ->select([Attribute::ID])
+            ->where([
+                'event' => $event,
+                'isActive' => true,
+            ])
+            ->findOne();
+
+        if (!$one) {
+            return;
+        }
+
+        $data = $this->dataCacheAccess->get();
+
+        unset($data[$event]);
+
+        $this->dataCacheAccess->set($data);
+        $this->dataCacheAccess->store();
+
+        $this->eventDispatcher->dispatch(new UpdateGlobal());
+    }
+
+    private function eventExists(string $event): bool
+    {
+        $data = $this->dataCacheAccess->get();
+
+        return isset($data[$event]);
+    }
+
+    private function logDebugEvent(string $event, Entity $entity): void
+    {
+        $this->log->debug("Webhook: {event} on record {id}.", [
+            'id' => $entity->getId(),
+            'event' => $event,
+        ]);
+    }
+
+    /**
+     * Process 'create' event.
+     */
+    public function processCreate(Entity $entity, Options $options): void
+    {
+        $event = "{$entity->getEntityType()}.create";
+
+        if (!$this->eventExists($event)) {
+            return;
+        }
+
+        $item = $this->entityManager->getRDBRepositoryByClass(WebhookEventQueueItem::class)->getNew();
+
+        $item
+            ->setEvent($event)
+            ->setTarget($entity)
+            ->setData($entity->getValueMap())
+            ->setUserId($options->userId);
+
+        $this->entityManager->saveEntity($item);
+
+        $this->logDebugEvent($event, $entity);
+    }
+
+    /**
+     * Process 'delete' event.
+     */
+    public function processDelete(Entity $entity, Options $options): void
+    {
+        $event = "{$entity->getEntityType()}.delete";
+
+        if (!$this->eventExists($event)) {
+            return;
+        }
+
+        $item = $this->entityManager->getRDBRepositoryByClass(WebhookEventQueueItem::class)->getNew();
+
+        $item
+            ->setEvent($event)
+            ->setTarget($entity)
+            ->setData(['id' => $entity->getId()])
+            ->setUserId($options->userId);
+
+        $this->entityManager->saveEntity($item);
+
+        $this->logDebugEvent($event, $entity);
+    }
+
+    /**
+     * Process 'update' event.
+     */
+    public function processUpdate(Entity $entity, Options $options): void
+    {
+        $event = "{$entity->getEntityType()}.update";
+
+        $data = (object) [];
+
+        foreach ($entity->getAttributeList() as $attribute) {
+            if (in_array($attribute, $this->skipAttributeList)) {
+                continue;
+            }
+
+            if ($entity->isAttributeChanged($attribute)) {
+                $data->$attribute = $entity->get($attribute);
+            }
+        }
+
+        if (!count(get_object_vars($data))) {
+            return;
+        }
+
+        $data->id = $entity->getId();
+
+        if ($this->eventExists($event)) {
+            $item = $this->entityManager->getRDBRepositoryByClass(WebhookEventQueueItem::class)->getNew();
+
+            $item
+                ->setEvent($event)
+                ->setTarget($entity)
+                ->setData($data)
+                ->setUserId($options->userId);
+
+            $this->entityManager->saveEntity($item);
+
+            $this->logDebugEvent($event, $entity);
+        }
+
+        $this->processUpdateFields($entity, $data, $options);
+    }
+
+    private function processUpdateFields(Entity $entity, stdClass $data, Options $options): void
+    {
+        foreach ($this->fieldUtil->getEntityTypeFieldList($entity->getEntityType()) as $field) {
+            $itemEvent = "{$entity->getEntityType()}.fieldUpdate.$field";
+
+            if (
+                !$this->eventExists($itemEvent) ||
+                !$this->isFieldChanged($entity, $field, $data)
+            ) {
+                continue;
+            }
+
+            $this->processUpdateField($entity, $field, $itemEvent, $options);
+        }
+    }
+
+    private function isFieldChanged(Entity $entity, string $field, stdClass $data): bool
+    {
+        $attributes = $this->fieldUtil->getActualAttributeList($entity->getEntityType(), $field);
+
+        $isChanged = false;
+
+        foreach ($attributes as $attribute) {
+            if (in_array($attribute, $this->skipAttributeList)) {
+                continue;
+            }
+
+            if (property_exists($data, $attribute)) {
+                $isChanged = true;
+
+                break;
+            }
+        }
+
+        return $isChanged;
+    }
+
+    private function processUpdateField(Entity $entity, string $field, string $itemEvent, Options $options): void
+    {
+        $itemData = (object) [];
+
+        $itemData->id = $entity->getId();
+
+        $attributeList = $this->fieldUtil->getAttributeList($entity->getEntityType(), $field);
+
+        foreach ($attributeList as $attribute) {
+            if (in_array($attribute, $this->skipAttributeList)) {
+                continue;
+            }
+
+            $itemData->$attribute = $entity->get($attribute);
+        }
+
+        $item = $this->entityManager->getRDBRepositoryByClass(WebhookEventQueueItem::class)->getNew();
+
+        $item
+            ->setEvent($itemEvent)
+            ->setTarget($entity)
+            ->setData($itemData)
+            ->setUserId($options->userId);
+
+        $this->entityManager->saveEntity($item);
+
+        $this->logDebugEvent($itemEvent, $entity);
+    }
+}

application/Espo/Core/Webhook/Options.php

@@ -0,0 +1,40 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Webhook;
+
+readonly class Options
+{
+    /**
+     * @param ?string $userId A user initiated an event.
+     */
+    public function __construct(
+        public ?string $userId = null,
+    ) {}
+}

application/Espo/Core/Webhook/Queue.php

@@ -0,0 +1,418 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Webhook;
+
+use Espo\Core\Field\DateTime;
+use Espo\Core\Field\LinkParent;
+use Espo\Core\Name\Field;
+use Espo\Entities\User;
+use Espo\Entities\Webhook;
+use Espo\Entities\WebhookEventQueueItem;
+use Espo\Entities\WebhookQueueItem;
+use Espo\Core\AclManager;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\DateTime as DateTimeUtil;
+use Espo\Core\Utils\Log;
+use Espo\ORM\EntityManager;
+use Espo\ORM\Name\Attribute;
+use Espo\ORM\Query\Part\Condition as Cond;
+use Espo\ORM\Query\SelectBuilder;
+use Exception;
+use stdClass;
+
+/**
+ * Groups occurred events into portions and sends them. A portion contains
+ * multiple events of the same webhook.
+ */
+class Queue
+{
+    private const EVENT_PORTION_SIZE = 20;
+    private const PORTION_SIZE = 20;
+    private const BATCH_SIZE = 50;
+    private const MAX_ATTEMPT_NUMBER = 4;
+    private const FAIL_ATTEMPT_PERIOD = '10 minutes';
+
+    public function __construct(
+        private Sender $sender,
+        private Config $config,
+        private EntityManager $entityManager,
+        private AclManager $aclManager,
+        private Log $log,
+    ) {}
+
+    public function process(): void
+    {
+        $this->processEvents();
+        $this->processSending();
+    }
+
+    protected function processEvents(): void
+    {
+        $portionSize = $this->config->get('webhookQueueEventPortionSize', self::EVENT_PORTION_SIZE);
+
+        $items = $this->entityManager
+            ->getRDBRepositoryByClass(WebhookEventQueueItem::class)
+            ->where(['isProcessed' => false])
+            ->order('number')
+            ->limit(0, $portionSize)
+            ->find();
+
+        foreach ($items as $item) {
+            $this->createQueueFromEvent($item);
+
+            $item->setIsProcessed();
+            $this->entityManager->saveEntity($item);
+        }
+    }
+
+    protected function createQueueFromEvent(WebhookEventQueueItem $eventItem): void
+    {
+        if (!$eventItem->getTargetId() || !$eventItem->getTargetType()) {
+            return;
+        }
+
+        $target = LinkParent::create($eventItem->getTargetType(), $eventItem->getTargetId());
+
+        $webhooks = $this->entityManager
+            ->getRDBRepositoryByClass(Webhook::class)
+            ->where([
+                'event' => $eventItem->getEvent(),
+                'isActive' => true,
+            ])
+            ->order(Field::CREATED_AT)
+            ->find();
+
+        foreach ($webhooks as $webhook) {
+            $this->createItem($eventItem, $webhook, $target);
+        }
+    }
+
+    protected function processSending(): void
+    {
+        $portionSize = $this->config->get('webhookQueuePortionSize', self::PORTION_SIZE);
+
+        $groupedItems = $this->entityManager
+            ->getRDBRepositoryByClass(WebhookQueueItem::class)
+            ->select([
+                'webhookId',
+                'number',
+            ])
+            ->where(
+                Cond::in(
+                    Cond::column('number'),
+                    $this->entityManager
+                        ->getQueryBuilder()
+                        ->select('MIN:(number)')
+                        ->from(WebhookQueueItem::ENTITY_TYPE)
+                        ->where([
+                            'status' => WebhookQueueItem::STATUS_PENDING,
+                            'OR' => [
+                                ['processAt' => null],
+                                ['processAt<=' => DateTimeUtil::getSystemNowString()],
+                            ],
+                        ])
+                        ->group('webhookId')
+                        ->build()
+                )
+            )
+            ->limit(0, $portionSize)
+            ->order('number')
+            ->find();
+
+        foreach ($groupedItems as $groupItem) {
+            $this->processSendingGroup($groupItem->getWebhookId());
+        }
+    }
+
+    private function processSendingGroup(string $webhookId): void
+    {
+        $batchSize = $this->config->get('webhookBatchSize', self::BATCH_SIZE);
+
+        $items = $this->entityManager
+            ->getRDBRepositoryByClass(WebhookQueueItem::class)
+            ->where([
+                'webhookId' => $webhookId,
+                'status' => WebhookQueueItem::STATUS_PENDING,
+                'OR' => [
+                    ['processAt' => null],
+                    ['processAt<=' => DateTimeUtil::getSystemNowString()],
+                ],
+            ])
+            ->order('number')
+            ->limit(0, $batchSize)
+            ->find();
+
+        $webhook = $this->entityManager->getRDBRepositoryByClass(Webhook::class)->getById($webhookId);
+
+        if (!$webhook || !$webhook->isActive()) {
+            foreach ($items as $item) {
+                $this->deleteQueueItem($item);
+            }
+
+            return;
+        }
+
+        $forbiddenAttributeList = [];
+
+        $user = null;
+
+        if ($webhook->getUserId()) {
+            $user = $this->entityManager->getRDBRepositoryByClass(User::class)->getById($webhook->getUserId());
+
+            if (!$user) {
+                foreach ($items as $item) {
+                    $this->deleteQueueItem($item);
+                }
+
+                return;
+            }
+
+            $forbiddenAttributeList = $this->aclManager
+                ->getScopeForbiddenAttributeList($user, $webhook->getTargetEntityType());
+        }
+
+        $actualItemList = [];
+
+        $dataList = [];
+
+        foreach ($items as $item) {
+            $data = $this->prepareItemData($item, $user, $forbiddenAttributeList);
+
+            if ($data === null) {
+                continue;
+            }
+
+            $actualItemList[] = $item;
+
+            $dataList[] = $data;
+        }
+
+        if ($dataList === []) {
+            return;
+        }
+
+        $this->send($webhook, $dataList, $actualItemList);
+    }
+
+    /**
+     * @param string[] $forbiddenAttributeList
+     */
+    private function prepareItemData(WebhookQueueItem $item, ?User $user, array $forbiddenAttributeList): ?stdClass
+    {
+        $targetType = $item->getTargetType();
+
+        if (!$targetType) {
+            $this->deleteQueueItem($item);
+
+            return null;
+        }
+
+        $target = null;
+
+        if ($this->entityManager->hasRepository($targetType)) {
+            $query = SelectBuilder::create()
+                ->from($targetType)
+                ->withDeleted()
+                ->build();
+
+            $target = $this->entityManager
+                ->getRDBRepository($targetType)
+                ->clone($query)
+                ->where([Attribute::ID => $item->getTargetId()])
+                ->findOne();
+        }
+
+        if (!$target) {
+            $this->deleteQueueItem($item);
+
+            return null;
+        }
+
+        if ($user) {
+            if (!$this->aclManager->check($user, $target)) {
+                $this->deleteQueueItem($item);
+
+                return null;
+            }
+        }
+
+        $data = $item->getData();
+
+        foreach ($forbiddenAttributeList as $attribute) {
+            unset($data->$attribute);
+        }
+
+        return $data;
+    }
+
+    /**
+     * @param stdClass[] $dataList
+     * @param WebhookQueueItem[] $itemList
+     */
+    private function send(Webhook $webhook, array $dataList, array $itemList): void
+    {
+        try {
+            $code = $this->sender->send($webhook, $dataList);
+        } catch (Exception $e) {
+            $this->failQueueItemList($itemList, true);
+
+            $this->log->error("Webhook Queue: Webhook '{id}' sending failed.", [
+                'exception' => $e,
+                'id' => $webhook->getId(),
+            ]);
+
+            return;
+        }
+
+        if ($code >= 200 && $code < 400) {
+            $this->succeedQueueItemList($itemList);
+        } else if ($code === 410) {
+            $this->dropWebhook($webhook);
+        } else if (in_array($code, [0, 401, 403, 404, 405, 408, 500, 503])) {
+            $this->failQueueItemList($itemList);
+        } else if ($code >= 400 && $code < 500) {
+            $this->failQueueItemList($itemList, true);
+        } else {
+            $this->failQueueItemList($itemList, true);
+        }
+
+        $this->logSending($webhook, $code);
+    }
+
+    protected function logSending(Webhook $webhook, int $code): void
+    {
+        $this->log->debug("Webhook Queue: Webhook '{id}' sent, response code: {code}.", [
+            'id' => $webhook->getId(),
+            'code' => $code,
+        ]);
+    }
+
+    /**
+     * @param WebhookQueueItem[] $itemList
+     */
+    protected function failQueueItemList(array $itemList, bool $force = false): void
+    {
+        foreach ($itemList as $item) {
+            $this->failQueueItem($item, $force);
+        }
+    }
+
+    /**
+     * @param WebhookQueueItem[] $itemList
+     */
+    protected function succeedQueueItemList(array $itemList): void
+    {
+        foreach ($itemList as $item) {
+            $this->succeedQueueItem($item);
+        }
+    }
+
+    protected function deleteQueueItem(WebhookQueueItem $item): void
+    {
+        $this->entityManager
+            ->getRDBRepository(WebhookQueueItem::ENTITY_TYPE)
+            ->deleteFromDb($item->getId());
+    }
+
+    protected function dropWebhook(Webhook $webhook): void
+    {
+        $items = $this->entityManager
+            ->getRDBRepositoryByClass(WebhookQueueItem::class)
+            ->where([
+                'status' => WebhookQueueItem::STATUS_PENDING,
+                'webhookId' => $webhook->getId(),
+            ])
+            ->order('number')
+            ->find();
+
+        foreach ($items as $item) {
+            $this->deleteQueueItem($item);
+        }
+
+        $this->entityManager->removeEntity($webhook);
+    }
+
+    protected function succeedQueueItem(WebhookQueueItem $item): void
+    {
+        $item
+            ->setAttempts($item->getAttempts() + 1)
+            ->setStatus(WebhookQueueItem::STATUS_SUCCESS)
+            ->setProcessedAt(DateTime::createNow());
+
+        $this->entityManager->saveEntity($item);
+    }
+
+    protected function failQueueItem(WebhookQueueItem $item, bool $force = false): void
+    {
+        $attempts = $item->getAttempts() + 1;
+
+        $maxAttemptsNumber = $this->config->get('webhookMaxAttemptNumber', self::MAX_ATTEMPT_NUMBER);
+        $period = $this->config->get('webhookFailAttemptPeriod', self::FAIL_ATTEMPT_PERIOD);
+
+        if ($force) {
+            $maxAttemptsNumber = 0;
+        }
+
+        $processAt = DateTime::createNow()->modify($period);
+
+        $item->setAttempts($attempts);
+        $item->setProcessAt($processAt);
+
+        if ($attempts >= $maxAttemptsNumber) {
+            $item->setStatus(WebhookQueueItem::STATUS_FAILED);
+            $item->setProcessAt(null);
+        }
+
+        $this->entityManager->saveEntity($item);
+    }
+
+    private function createItem(WebhookEventQueueItem $eventItem, Webhook $webhook, LinkParent $target): void
+    {
+        if (
+            $webhook->skipOwn() &&
+            $webhook->getUserId() &&
+            $eventItem->getUserId() === $webhook->getUserId()
+        ) {
+            return;
+        }
+
+        $item = $this->entityManager->getRDBRepositoryByClass(WebhookQueueItem::class)->getNew();
+
+        $item
+            ->setEvent($eventItem->getEvent())
+            ->setWebhook($webhook)
+            ->setTarget($target)
+            ->setStatus(WebhookQueueItem::STATUS_PENDING)
+            ->setAttempts(0)
+            ->setData($eventItem->getData());
+
+        $this->entityManager->saveEntity($item);
+    }
+}

application/Espo/Core/Webhook/Sender.php

@@ -0,0 +1,203 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2026 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Webhook;
+
+use Espo\Core\Api\Method;
+use Espo\Core\Api\Route\ContentType;
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Json;
+use Espo\Core\Utils\Security\UrlCheck;
+use Espo\Entities\Webhook;
+use Espo\Core\HttpClient;
+use LogicException;
+use Psr\Http\Message\RequestInterface;
+use SensitiveParameter;
+
+/**
+ * Sends a portion.
+ */
+class Sender
+{
+    private const int CONNECT_TIMEOUT = 5;
+    private const int TIMEOUT = 10;
+
+    public function __construct(
+        private Config $config,
+        private UrlCheck $urlCheck,
+        private HttpClient\ClientFactory $clientFactory,
+    ) {}
+
+    /**
+     * @param array<int, mixed> $dataList
+     * @throws Error
+     */
+    public function send(Webhook $webhook, array $dataList): int
+    {
+        $payload = Json::encode($dataList);
+
+        [$signature, $legacySignature] = $this->prepareSignatures($webhook, $payload);
+
+        $options = new HttpClient\Options(
+            protocols: [HttpClient\Protocol::https, HttpClient\Protocol::http],
+            redirect: new HttpClient\Options\Redirect(
+                allow: true,
+                protocols: [HttpClient\Protocol::https],
+            ),
+            timeout: $this->getTimeout(),
+            connectTimeout: $this->getConnectTimeout(),
+            internalHostRestriction: new HttpClient\Options\InternalHostRestriction(
+                restrict: true,
+                allowed: $this->getAllowedAddressList(),
+            ),
+        );
+
+        $request = $this->prepareRequest(
+            url: $this->getUrl($webhook),
+            payload: $payload,
+            signature: $signature,
+            legacySignature: $legacySignature,
+        );
+
+        $client = $this->clientFactory->create($options);
+
+        try {
+            $response = $client->send($request);
+        } catch (HttpClient\Exceptions\ConnectException $e) {
+            if ($e->getReason() === HttpClient\ConnectErrorReason::Timeout) {
+                return 408;
+            }
+
+            throw new Error("Connect error.", previous: $e);
+        } catch (HttpClient\Exceptions\TooManyRedirectsException $e) {
+            throw new Error("Too many redirects.", previous: $e);
+        }
+
+        return $response->getStatusCode();
+    }
+
+    private function buildSignature(Webhook $webhook, string $payload, #[SensitiveParameter] string $secretKey): string
+    {
+        $webhookId = $webhook->getId();
+        $hash = hash_hmac('sha256', $payload, $secretKey);
+
+        return base64_encode("$webhookId:$hash");
+    }
+
+    /**
+     * @todo Remove in v11.0.
+     */
+    private function buildSignatureLegacy(Webhook $webhook, string $payload, string $secretKey): string
+    {
+        return base64_encode($webhook->getId() . ':' . hash_hmac('sha256', $payload, $secretKey, true));
+    }
+
+    /**
+     * @return string
+     * @throws Error
+     */
+    private function getUrl(Webhook $webhook): string
+    {
+        $url = $webhook->getUrl() ?? throw new Error("Webhook does not have URL.");
+
+        if (!$this->urlCheck->isUrl($url)) {
+            throw new Error("'$url' is not valid URL.");
+        }
+
+        return $url;
+    }
+
+    /**
+     * @return string[]
+     */
+    private function getAllowedAddressList(): array
+    {
+        /** @var string[] $allowedAddressList */
+        $allowedAddressList = $this->config->get('webhookAllowedAddressList') ?? [];
+
+        return $allowedAddressList;
+    }
+
+    private function prepareRequest(
+        string $url,
+        string $payload,
+        ?string $signature,
+        ?string $legacySignature,
+    ): RequestInterface {
+
+        $request = HttpClient\RequestCreator::create(Method::POST, $url)
+            ->withHeader('Content-Type', ContentType::APPLICATION_JSON)
+            ->withHeader('Content-Length', (string) strlen($payload));
+
+        if ($signature) {
+            $request = $request->withHeader('Signature', $signature);
+        }
+
+        if ($legacySignature) {
+            $request = $request->withHeader('X-Signature', $legacySignature);
+        }
+
+        $request = $request->withBody(HttpClient\Util::streamFor($payload));
+
+        if (!$request instanceof RequestInterface) {
+            throw new LogicException();
+        }
+
+        return $request;
+    }
+
+    /**
+     * @return array{0: ?string, 1: ?string}
+     */
+    private function prepareSignatures(Webhook $webhook, string $payload): array
+    {
+        $signature = null;
+        $legacySignature = null;
+
+        $secretKey = $webhook->getSecretKey();
+
+        if ($secretKey) {
+            $signature = $this->buildSignature($webhook, $payload, $secretKey);
+            $legacySignature = $this->buildSignatureLegacy($webhook, $payload, $secretKey);
+        }
+
+        return [$signature, $legacySignature];
+    }
+
+    private function getConnectTimeout(): ?int
+    {
+        return $this->config->get('webhookConnectTimeout', self::CONNECT_TIMEOUT);
+    }
+
+    private function getTimeout(): ?int
+    {
+        return $this->config->get('webhookTimeout', self::TIMEOUT);
+    }
+}