snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/metadata/suites/developers/api-keys.integration-spec.ts

@@ -0,0 +1,473 @@
+import { gql } from 'graphql-tag';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { makeRestAPIRequest } from 'test/integration/rest/utils/make-rest-api-request.util';
+
+describe('apiKeysResolver (e2e)', () => {
+  let createdApiKeyId: string | undefined;
+  let adminRoleId: string;
+
+  const createRevokedApiKey = async (name: string): Promise<string> => {
+    const createResponse = await makeMetadataAPIRequest({
+      query: gql`
+        mutation CreateApiKey($input: CreateApiKeyInput!) {
+          createApiKey(input: $input) {
+            id
+          }
+        }
+      `,
+      variables: {
+        input: {
+          name,
+          expiresAt: '2025-12-31T23:59:59Z',
+          roleId: adminRoleId,
+        },
+      },
+    });
+
+    const apiKeyId = createResponse.body.data.createApiKey.id;
+
+    createdApiKeyId = apiKeyId;
+
+    await makeMetadataAPIRequest({
+      query: gql`
+        mutation RevokeApiKey($input: RevokeApiKeyInput!) {
+          revokeApiKey(input: $input) {
+            id
+          }
+        }
+      `,
+      variables: {
+        input: { id: apiKeyId },
+      },
+    });
+
+    return apiKeyId;
+  };
+
+  const findApiKeyRevokedAt = async (
+    apiKeyId: string,
+  ): Promise<string | null> => {
+    const apiKeyResponse = await makeMetadataAPIRequest({
+      query: gql`
+        query GetApiKey($input: GetApiKeyInput!) {
+          apiKey(input: $input) {
+            revokedAt
+          }
+        }
+      `,
+      variables: {
+        input: { id: apiKeyId },
+      },
+    });
+
+    return apiKeyResponse.body.data.apiKey.revokedAt;
+  };
+
+  beforeAll(async () => {
+    const rolesResponse = await makeMetadataAPIRequest({
+      query: gql`
+        query GetRoles {
+          getRoles {
+            id
+            label
+          }
+        }
+      `,
+    });
+
+    if (rolesResponse.body.errors) {
+      throw new Error(
+        `Failed to get roles: ${JSON.stringify(rolesResponse.body.errors)}`,
+      );
+    }
+
+    adminRoleId = rolesResponse.body.data.getRoles.find(
+      (r: { label: string }) => r.label === 'Admin',
+    )?.id as string;
+  });
+
+  afterEach(async () => {
+    if (createdApiKeyId) {
+      await testDataSource
+        .query('DELETE FROM core."apiKey" WHERE id = $1', [createdApiKeyId])
+        .catch(() => {});
+      createdApiKeyId = undefined;
+    }
+  });
+
+  describe('apiKeys query', () => {
+    it('should find many API keys', async () => {
+      const response = await makeMetadataAPIRequest({
+        query: gql`
+          query GetApiKeys {
+            apiKeys {
+              id
+              name
+              expiresAt
+              revokedAt
+              role {
+                id
+                label
+                icon
+              }
+            }
+          }
+        `,
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.data).toBeDefined();
+      expect(response.body.errors).toBeUndefined();
+      expect(response.body.data.apiKeys).toBeDefined();
+      expect(Array.isArray(response.body.data.apiKeys)).toBe(true);
+    });
+  });
+
+  describe('createApiKey mutation', () => {
+    it('should create an API key successfully', async () => {
+      const apiKeyInput = {
+        name: 'Test API Key',
+        expiresAt: '2025-12-31T23:59:59Z',
+        roleId: adminRoleId,
+      };
+
+      const response = await makeMetadataAPIRequest({
+        query: gql`
+          mutation CreateApiKey($input: CreateApiKeyInput!) {
+            createApiKey(input: $input) {
+              id
+              name
+              expiresAt
+              revokedAt
+              role {
+                id
+                label
+              }
+            }
+          }
+        `,
+        variables: {
+          input: apiKeyInput,
+        },
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.data).toBeDefined();
+      expect(response.body.errors).toBeUndefined();
+
+      const createdApiKey = response.body.data.createApiKey;
+
+      expect(createdApiKey).toBeDefined();
+      expect(createdApiKey.id).toBeDefined();
+      expect(createdApiKey.name).toBe(apiKeyInput.name);
+      expect(createdApiKey.expiresAt).toBe('2025-12-31T23:59:59.000Z');
+      expect(createdApiKey.revokedAt).toBeNull();
+      expect(createdApiKey.role).toBeDefined();
+      expect(createdApiKey.role.id).toBe(adminRoleId);
+      expect(createdApiKey.role.label).toBe('Admin');
+
+      createdApiKeyId = createdApiKey.id;
+    });
+
+    it('should fail to create API key with invalid expiry date', async () => {
+      const apiKeyInput = {
+        name: 'Test API Key',
+        expiresAt: 'invalid-date',
+        roleId: adminRoleId,
+      };
+
+      const response = await makeMetadataAPIRequest({
+        query: gql`
+          mutation CreateApiKey($input: CreateApiKeyInput!) {
+            createApiKey(input: $input) {
+              id
+              name
+              expiresAt
+              revokedAt
+              roleId
+            }
+          }
+        `,
+        variables: {
+          input: apiKeyInput,
+        },
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeDefined();
+      expect(response.body.errors.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe('updateApiKey mutation', () => {
+    it('should update an API key successfully', async () => {
+      const createResponse = await makeMetadataAPIRequest({
+        query: gql`
+          mutation CreateApiKey($input: CreateApiKeyInput!) {
+            createApiKey(input: $input) {
+              id
+              name
+              expiresAt
+              revokedAt
+              role {
+                id
+                label
+              }
+            }
+          }
+        `,
+        variables: {
+          input: {
+            name: 'Test API Key',
+            expiresAt: '2025-12-31T23:59:59Z',
+            roleId: adminRoleId,
+          },
+        },
+      });
+
+      const createdApiKey = createResponse.body.data.createApiKey;
+
+      createdApiKeyId = createdApiKey.id;
+
+      const updateInput = {
+        id: createdApiKey.id,
+        name: 'Updated API Key',
+        expiresAt: '2026-01-01T00:00:00Z',
+      };
+
+      const updateResponse = await makeMetadataAPIRequest({
+        query: gql`
+          mutation UpdateApiKey($input: UpdateApiKeyInput!) {
+            updateApiKey(input: $input) {
+              id
+              name
+              expiresAt
+              revokedAt
+              role {
+                id
+                label
+              }
+            }
+          }
+        `,
+        variables: {
+          input: updateInput,
+        },
+      });
+
+      expect(updateResponse.status).toBe(200);
+      expect(updateResponse.body.data).toBeDefined();
+      expect(updateResponse.body.errors).toBeUndefined();
+
+      const updatedApiKey = updateResponse.body.data.updateApiKey;
+
+      expect(updatedApiKey).toBeDefined();
+      expect(updatedApiKey.id).toBe(createdApiKey.id);
+      expect(updatedApiKey.name).toBe(updateInput.name);
+      expect(updatedApiKey.expiresAt).toBe('2026-01-01T00:00:00.000Z');
+      expect(updatedApiKey.revokedAt).toBeNull();
+      expect(updatedApiKey.role).toBeDefined();
+      expect(updatedApiKey.role.id).toBe(adminRoleId);
+    });
+
+    it('should not reactivate a revoked API key', async () => {
+      const apiKeyId = await createRevokedApiKey('Test API Key to Reactivate');
+
+      const updateResponse = await makeMetadataAPIRequest({
+        query: gql`
+          mutation UpdateApiKey($input: UpdateApiKeyInput!) {
+            updateApiKey(input: $input) {
+              id
+              revokedAt
+            }
+          }
+        `,
+        variables: {
+          input: { id: apiKeyId, revokedAt: null },
+        },
+      });
+
+      expect(updateResponse.status).toBe(200);
+      expect(updateResponse.body.data.updateApiKey).toBeNull();
+      expect(updateResponse.body.errors).toHaveLength(1);
+      expect(updateResponse.body.errors[0].extensions.code).toBe('FORBIDDEN');
+      expect(updateResponse.body.errors[0].extensions.userFriendlyMessage).toBe(
+        'This API key has been revoked and cannot be reactivated. Please create a new API key.',
+      );
+      expect(await findApiKeyRevokedAt(apiKeyId)).not.toBeNull();
+    });
+
+    it('should rename a revoked API key without reactivating it', async () => {
+      const apiKeyId = await createRevokedApiKey('Test API Key to Rename');
+
+      const updateResponse = await makeMetadataAPIRequest({
+        query: gql`
+          mutation UpdateApiKey($input: UpdateApiKeyInput!) {
+            updateApiKey(input: $input) {
+              id
+              name
+              revokedAt
+            }
+          }
+        `,
+        variables: {
+          input: { id: apiKeyId, name: 'Renamed Revoked API Key' },
+        },
+      });
+
+      expect(updateResponse.status).toBe(200);
+      expect(updateResponse.body.errors).toBeUndefined();
+      expect(updateResponse.body.data.updateApiKey.name).toBe(
+        'Renamed Revoked API Key',
+      );
+      expect(updateResponse.body.data.updateApiKey.revokedAt).not.toBeNull();
+    });
+  });
+
+  describe('PATCH /rest/metadata/apiKeys/:id', () => {
+    it('should not reactivate a revoked API key', async () => {
+      const apiKeyId = await createRevokedApiKey(
+        'Test API Key to Reactivate via REST',
+      );
+
+      const response = await makeRestAPIRequest({
+        method: 'patch',
+        path: `/metadata/apiKeys/${apiKeyId}`,
+        bearer: APPLE_JANE_ADMIN_ACCESS_TOKEN,
+        body: { revokedAt: null },
+      });
+
+      expect(response.status).toBe(400);
+      expect(response.body.code).toBe('API_KEY_REVOKED');
+      expect(await findApiKeyRevokedAt(apiKeyId)).not.toBeNull();
+    });
+  });
+
+  describe('apiKey query', () => {
+    it('should find a specific API key', async () => {
+      const createResponse = await makeMetadataAPIRequest({
+        query: gql`
+          mutation CreateApiKey($input: CreateApiKeyInput!) {
+            createApiKey(input: $input) {
+              id
+              name
+              expiresAt
+              revokedAt
+              role {
+                id
+                label
+              }
+            }
+          }
+        `,
+        variables: {
+          input: {
+            name: 'Test API Key',
+            expiresAt: '2025-12-31T23:59:59Z',
+            roleId: adminRoleId,
+          },
+        },
+      });
+
+      const createdApiKey = createResponse.body.data.createApiKey;
+
+      createdApiKeyId = createdApiKey.id;
+
+      const apiKeyResponse = await makeMetadataAPIRequest({
+        query: gql`
+          query GetApiKey($input: GetApiKeyInput!) {
+            apiKey(input: $input) {
+              id
+              name
+              expiresAt
+              revokedAt
+              role {
+                id
+                label
+              }
+            }
+          }
+        `,
+        variables: {
+          input: { id: createdApiKey.id },
+        },
+      });
+
+      expect(apiKeyResponse.status).toBe(200);
+      expect(apiKeyResponse.body.data).toBeDefined();
+      expect(apiKeyResponse.body.errors).toBeUndefined();
+
+      const foundApiKey = apiKeyResponse.body.data.apiKey;
+
+      expect(foundApiKey).toBeDefined();
+      expect(foundApiKey.id).toBe(createdApiKey.id);
+      expect(foundApiKey.name).toBe('Test API Key');
+      expect(foundApiKey.role).toBeDefined();
+      expect(foundApiKey.role.id).toBe(adminRoleId);
+    });
+  });
+
+  describe('revokeApiKey mutation', () => {
+    it('should revoke an API key successfully', async () => {
+      const createResponse = await makeMetadataAPIRequest({
+        query: gql`
+          mutation CreateApiKey($input: CreateApiKeyInput!) {
+            createApiKey(input: $input) {
+              id
+              name
+              expiresAt
+              revokedAt
+              role {
+                id
+                label
+              }
+            }
+          }
+        `,
+        variables: {
+          input: {
+            name: 'Test API Key for Revoke',
+            expiresAt: '2025-12-31T23:59:59Z',
+            roleId: adminRoleId,
+          },
+        },
+      });
+
+      const createdApiKey = createResponse.body.data.createApiKey;
+
+      createdApiKeyId = createdApiKey.id;
+
+      const revokeResponse = await makeMetadataAPIRequest({
+        query: gql`
+          mutation RevokeApiKey($input: RevokeApiKeyInput!) {
+            revokeApiKey(input: $input) {
+              id
+              name
+              expiresAt
+              revokedAt
+              role {
+                id
+                label
+              }
+            }
+          }
+        `,
+        variables: {
+          input: { id: createdApiKeyId },
+        },
+      });
+
+      expect(revokeResponse.status).toBe(200);
+      expect(revokeResponse.body.data).toBeDefined();
+      expect(revokeResponse.body.errors).toBeUndefined();
+
+      const revokedApiKey = revokeResponse.body.data.revokeApiKey;
+
+      expect(revokedApiKey).toBeDefined();
+      expect(revokedApiKey.id).toBe(createdApiKeyId);
+      expect(revokedApiKey.revokedAt).toBeDefined();
+      expect(revokedApiKey.role).toBeDefined();
+      expect(revokedApiKey.role.id).toBe(adminRoleId);
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/developers/webhooks.integration-spec.ts

@@ -0,0 +1,355 @@
+import { gql } from 'graphql-tag';
+import { makeGraphqlAPIRequest } from 'test/integration/graphql/utils/make-graphql-api-request.util';
+import {
+  createWebhook,
+  createWebhookReceiver,
+  deleteWebhook,
+  getWebhook,
+  getWebhooks,
+  updateWebhook,
+} from 'test/integration/metadata/suites/utils/webhook-test.util';
+import { makeAdminPanelAPIRequest } from 'test/integration/twenty-config/utils/make-admin-panel-api-request.util';
+import { expectEventually } from 'test/integration/utils/expect-eventually.util';
+import { v4 as uuidv4 } from 'uuid';
+
+import { type UpdateWebhookInput } from 'src/engine/metadata-modules/webhook/dtos/update-webhook.input';
+
+const CREATE_CONFIG_VARIABLE_MUTATION = gql`
+  mutation CreateDatabaseConfigVariable($key: String!, $value: JSON!) {
+    createDatabaseConfigVariable(key: $key, value: $value)
+  }
+`;
+
+const GET_CONFIG_VARIABLE_QUERY = gql`
+  query GetDatabaseConfigVariable($key: String!) {
+    getDatabaseConfigVariable(key: $key) {
+      value
+      source
+    }
+  }
+`;
+
+const DELETE_CONFIG_VARIABLE_MUTATION = gql`
+  mutation DeleteDatabaseConfigVariable($key: String!) {
+    deleteDatabaseConfigVariable(key: $key)
+  }
+`;
+
+const DESTROY_PERSON_MUTATION = gql`
+  mutation DestroyPerson($id: ID!) {
+    destroyPerson(id: $id) {
+      id
+    }
+  }
+`;
+
+const CREATE_PERSON_MUTATION = gql`
+  mutation CreatePerson($data: PersonCreateInput!) {
+    createPerson(data: $data) {
+      id
+      name {
+        firstName
+        lastName
+      }
+    }
+  }
+`;
+
+describe('webhooksResolver (e2e)', () => {
+  let createdWebhookId: string | undefined;
+  let createdPersonId: string | undefined;
+
+  afterEach(async () => {
+    if (createdPersonId) {
+      await makeGraphqlAPIRequest({
+        query: DESTROY_PERSON_MUTATION,
+        variables: { id: createdPersonId },
+      }).catch(() => {});
+      createdPersonId = undefined;
+    }
+
+    if (createdWebhookId) {
+      await deleteWebhook(createdWebhookId).catch(() => {});
+      createdWebhookId = undefined;
+    }
+  });
+
+  describe('webhooks query', () => {
+    it('should find many webhooks', async () => {
+      const response = await getWebhooks();
+
+      expect(response.status).toBe(200);
+      expect(response.body.data).toBeDefined();
+      expect(response.body.errors).toBeUndefined();
+      expect(response.body.data.webhooks).toBeDefined();
+      expect(Array.isArray(response.body.data.webhooks)).toBe(true);
+    });
+  });
+
+  describe('createWebhook mutation', () => {
+    it('should create a webhook successfully', async () => {
+      const webhookInput = {
+        targetUrl: 'https://example.com/webhook',
+        operations: ['person.created', 'company.updated'],
+        description: 'Test webhook',
+        secret: 'test-secret',
+      };
+
+      const response = await createWebhook(webhookInput);
+
+      expect(response.status).toBe(200);
+      expect(response.body.data).toBeDefined();
+      expect(response.body.errors).toBeUndefined();
+
+      const createdWebhookData = response.body.data.createWebhook;
+
+      expect(createdWebhookData).toBeDefined();
+      expect(createdWebhookData.id).toBeDefined();
+      expect(createdWebhookData.targetUrl).toBe(webhookInput.targetUrl);
+      expect(createdWebhookData.operations).toEqual(webhookInput.operations);
+      expect(createdWebhookData.description).toBe(webhookInput.description);
+      expect(createdWebhookData.secret).toBe(webhookInput.secret);
+
+      createdWebhookId = createdWebhookData.id;
+    });
+
+    it('should fail to create webhook with invalid URL', async () => {
+      const webhookInput = {
+        targetUrl: 'invalid-url',
+        operations: ['person.created'],
+        description: 'Test webhook',
+        secret: 'test-secret',
+      };
+
+      const response = await createWebhook(webhookInput);
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeDefined();
+      expect(response.body.errors.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe('updateWebhook mutation', () => {
+    it('should update a webhook successfully', async () => {
+      const createResponse = await createWebhook({
+        targetUrl: 'https://example.com/webhook',
+        operations: ['person.created'],
+        description: 'Test webhook',
+        secret: 'test-secret',
+      });
+
+      const createdWebhookData = createResponse.body.data.createWebhook;
+
+      createdWebhookId = createdWebhookData.id;
+
+      const updateInput: UpdateWebhookInput = {
+        id: createdWebhookData.id,
+        update: {
+          targetUrl: 'https://updated.com/webhook',
+          operations: ['person.updated', 'company.created'],
+          description: 'Updated webhook',
+          secret: 'updated-secret',
+        },
+      };
+
+      const updateResponse = await updateWebhook(updateInput);
+
+      expect(updateResponse.status).toBe(200);
+      expect(updateResponse.body.data).toBeDefined();
+      expect(updateResponse.body.errors).toBeUndefined();
+
+      const updatedWebhookData = updateResponse.body.data.updateWebhook;
+
+      expect(updatedWebhookData.id).toBe(createdWebhookData.id);
+      expect(updatedWebhookData.targetUrl).toBe(updateInput.update.targetUrl);
+      expect(updatedWebhookData.operations).toEqual(
+        updateInput.update.operations,
+      );
+      expect(updatedWebhookData.description).toBe(
+        updateInput.update.description,
+      );
+      expect(updatedWebhookData.secret).toBe(updateInput.update.secret);
+    });
+  });
+
+  describe('webhook query', () => {
+    it('should find a specific webhook', async () => {
+      const createResponse = await createWebhook({
+        targetUrl: 'https://example.com/webhook',
+        operations: ['person.created'],
+        description: 'Test webhook',
+        secret: 'test-secret',
+      });
+
+      const createdWebhookData = createResponse.body.data.createWebhook;
+
+      createdWebhookId = createdWebhookData.id;
+
+      const queryResponse = await getWebhook(createdWebhookData.id);
+
+      expect(queryResponse.status).toBe(200);
+      expect(queryResponse.body.data).toBeDefined();
+      expect(queryResponse.body.errors).toBeUndefined();
+
+      const webhookData = queryResponse.body.data.webhook;
+
+      expect(webhookData).toBeDefined();
+      expect(webhookData.id).toBe(createdWebhookData.id);
+      expect(webhookData.targetUrl).toBe(createdWebhookData.targetUrl);
+      expect(webhookData.operations).toEqual(createdWebhookData.operations);
+      expect(webhookData.description).toBe(createdWebhookData.description);
+      expect(webhookData.secret).toBe(createdWebhookData.secret);
+    });
+  });
+
+  describe('deleteWebhook mutation', () => {
+    it('should delete a webhook successfully', async () => {
+      const createResponse = await createWebhook({
+        targetUrl: 'https://example.com/webhook',
+        operations: ['person.created'],
+        description: 'Test webhook',
+        secret: 'test-secret',
+      });
+
+      const createdWebhookData = createResponse.body.data.createWebhook;
+
+      const deleteResponse = await deleteWebhook(createdWebhookData.id);
+
+      expect(deleteResponse.status).toBe(200);
+      expect(deleteResponse.body.data).toBeDefined();
+      expect(deleteResponse.body.errors).toBeUndefined();
+
+      const queryResponse = await getWebhook(createdWebhookData.id);
+
+      expect(queryResponse.status).toBe(200);
+      expect(queryResponse.body.data.webhook).toBeNull();
+
+      createdWebhookId = undefined;
+    });
+  });
+
+  describe('webhook delivery', () => {
+    const WEBHOOK_RECEIVER_PORT = 4317;
+
+    it('should block delivery to private IP when safe mode is enabled (SSRF protection)', async () => {
+      const receiver = await createWebhookReceiver(WEBHOOK_RECEIVER_PORT);
+
+      try {
+        const createWebhookResponse = await createWebhook({
+          targetUrl: `http://127.0.0.1:${WEBHOOK_RECEIVER_PORT}/webhook`,
+          operations: ['person.created'],
+          description: 'SSRF test webhook',
+          secret: 'test-secret',
+        });
+
+        expect(createWebhookResponse.body.errors).toBeUndefined();
+        createdWebhookId = createWebhookResponse.body.data.createWebhook.id;
+
+        const testId = uuidv4().slice(0, 8);
+        const createPersonResponse = await makeGraphqlAPIRequest({
+          query: CREATE_PERSON_MUTATION,
+          variables: {
+            data: {
+              name: {
+                firstName: 'SSRFTest',
+                lastName: `User-${testId}`,
+              },
+            },
+          },
+        });
+
+        expect(createPersonResponse.status).toBe(200);
+        expect(createPersonResponse.body.errors).toBeUndefined();
+        createdPersonId = createPersonResponse.body.data.createPerson.id;
+
+        jest.useRealTimers();
+        await new Promise((resolve) => setTimeout(resolve, 100));
+        jest.useFakeTimers();
+
+        expect(receiver.receivedPayloads.length).toBe(0);
+      } finally {
+        await receiver.close();
+      }
+    });
+
+    it('should deliver webhook successfully when internal hosts are allowed', async () => {
+      jest.useRealTimers();
+
+      const receiver = await createWebhookReceiver(WEBHOOK_RECEIVER_PORT);
+
+      try {
+        const createConfigResponse = await makeAdminPanelAPIRequest({
+          query: CREATE_CONFIG_VARIABLE_MUTATION,
+          variables: {
+            key: 'OUTBOUND_HTTP_ALLOWED_INTERNAL_HOSTS',
+            value: ['*'],
+          },
+        });
+
+        expect(createConfigResponse.body.errors).toBeUndefined();
+        expect(
+          createConfigResponse.body.data.createDatabaseConfigVariable,
+        ).toBe(true);
+
+        const verifyConfig = await makeAdminPanelAPIRequest({
+          query: GET_CONFIG_VARIABLE_QUERY,
+          variables: { key: 'OUTBOUND_HTTP_ALLOWED_INTERNAL_HOSTS' },
+        });
+
+        expect(verifyConfig.body.data.getDatabaseConfigVariable.value).toEqual([
+          '*',
+        ]);
+        expect(verifyConfig.body.data.getDatabaseConfigVariable.source).toBe(
+          'DATABASE',
+        );
+
+        const createWebhookResponse = await createWebhook({
+          targetUrl: `http://127.0.0.1:${WEBHOOK_RECEIVER_PORT}/webhook`,
+          operations: ['person.created'],
+          description: 'Delivery test webhook',
+          secret: 'test-secret',
+        });
+
+        expect(createWebhookResponse.body.errors).toBeUndefined();
+        createdWebhookId = createWebhookResponse.body.data.createWebhook.id;
+
+        const testId = uuidv4().slice(0, 8);
+        const createPersonResponse = await makeGraphqlAPIRequest({
+          query: CREATE_PERSON_MUTATION,
+          variables: {
+            data: {
+              name: {
+                firstName: 'WebhookDelivery',
+                lastName: `Test-${testId}`,
+              },
+            },
+          },
+        });
+
+        expect(createPersonResponse.status).toBe(200);
+        expect(createPersonResponse.body.errors).toBeUndefined();
+        createdPersonId = createPersonResponse.body.data.createPerson.id;
+
+        // Delivery crosses two BullMQ hops behind a fire-and-forget event
+        // emit, so poll the receiver instead of guessing at the latency.
+        await expectEventually(
+          () => {
+            expect(receiver.receivedPayloads.length).toBe(1);
+            expect(receiver.receivedPayloads[0]).toMatchObject({
+              targetUrl: `http://127.0.0.1:${WEBHOOK_RECEIVER_PORT}/webhook`,
+              eventName: 'person.created',
+            });
+          },
+          { timeoutMs: 30_000, intervalMs: 100 },
+        );
+      } finally {
+        await receiver.close();
+        await makeAdminPanelAPIRequest({
+          query: DELETE_CONFIG_VARIABLE_MUTATION,
+          variables: { key: 'OUTBOUND_HTTP_ALLOWED_INTERNAL_HOSTS' },
+        }).catch(() => {});
+        jest.useFakeTimers();
+      }
+    }, 60_000);
+  });
+});