[Aydin Hassan (AydinHassan)]

Summary

Adds a guide for webhooks created through the Admin API by users and integrations: ownership, which events a webhook receives, aclRoleIds, who can change or delete it, allowed URLs, the payload, and the "Legacy webhooks" migration. The app webhook guide links to it.

Related links

ADR: https://github.com/shopware/shopware/blob/trunk/adr/2026-09-29-authorize-webhooks-against-their-owner.md

Checklist

• I reviewed affected links, code samples, and cross-references, including PageRef references where relevant.
• I added or updated redirects in .gitbook.yaml if pages were moved, renamed, or deleted.
• I updated .wordlist.txt (and sorted it) if spellcheck flags new legitimate terms.
• I listed every dependent pull request that is not merged yet under Dependent PRs below.
• Dependent changes that must be released, not only merged, before this documentation goes live have been published.
• This pull request is ready for review.

Dependent PRs

Notes

The Shopware changes are merged but only ship with 6.7.17.0, so the release box stays unticked: please merge this only once 6.7.17.0 is out.

[shopware-dev-docs-connector]

Developer Docs healthcheck

Status: Completed with success.
Repository: shopware/docs
Commit: e014c8a
Preview: https://developer-documentation-c1jbkswg8-shopware-frontends.vercel.app
Workflow run: #5822

[github-actions]

📢 Developer Announcement Recommendation

Recommendation: ❌ No Announcement Recommended

No developer announcement signals were detected.

This PR does not appear to introduce developer-facing changes that require a community announcement.

[Copilot]

🔵 Needs a closer look

A maintainer must confirm that Shopware 6.7.17.0 has been released before merging this release-dependent documentation.

2 open issues

• Scope subscription validation to event or ACL updates · New
• Clarify unsigned Admin API webhook limitations · New

What changed in this PR

Adds an Admin API webhook guide to the Shopware developer documentation, distinguishing user- and integration-owned webhooks from manifest-registered app webhooks.

Changes:

• Documents creation, ownership, permissions, role restrictions, and lifecycle rules.
• Covers target URL restrictions, payloads, and legacy webhook migration.
• Links the app webhook guide to the new guide.

File	Description
guides/​plugins/​apps/​lifecycle/​webhook.md	Clarifies scope and links to Admin API webhooks.
guides/​development/​integrations-api/​webhooks.md	Adds the Admin API webhook guide and migration guidance.

_{Review effort: Balanced}

[Aydin Hassan (AydinHassan)]

📢 Developer Announcement Recommendation

Recommendation: ❌ No Announcement Recommended

No developer announcement signals were detected.

This PR does not appear to introduce developer-facing changes that require a community announcement.

I think this does warrant an announcement: specifically about auditing of legacy webhooks.

Also, it could be there is a better place for this guide, i'm open for suggestions!