# Extra\_vars to Webhooks in AWX?

**URL:** <https://forum.ansible.com/t/extra-vars-to-webhooks-in-awx/4926>\
**Category:** Get Help\
**Tags:** api, awx\
**Created:** [April 12, 2024, 11:33am UTC](https://forum.ansible.com/t/extra-vars-to-webhooks-in-awx/4926 "2024-04-12T11:33:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\
**Post date:** [April 12, 2024, 11:33am UTC](https://forum.ansible.com/t/extra-vars-to-webhooks-in-awx/4926/1 "2024-04-12T11:33:46Z")

</div>

When a Webhook POSTed to AWX provides a payload containing `extra_vars` and other things, the values are made available in AWX as `"{awx,tower}_webhook_payload"`. Is it by design that `extra_vars` isn’t merged with other variables for the job template run?

A payload of

```json
{"hackby":"JPM", "extra_vars":{"drink":"coffee"}}

```

is made available in the playbook as

```json
"awx_webhook_payload": {
    "hackby": "JPM",
    "extra_vars": {
      "drink": "coffee"
    }
  }

```

I had expected `"drink"` to not be nested like that, but it may be for security reasons. Is that so?

I can’t find any mention of payload parameters in the docs, nor have I found an open issue in ansible/awx.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [April 12, 2024, 6:33pm UTC](https://forum.ansible.com/t/extra-vars-to-webhooks-in-awx/4926/2 "2024-04-12T18:33:28Z")

</div>

From /api/v2/job\_templats/\<job\_id\>/launch/

In `.description` of the json options:  
`If any passwords, inventory, or extra variables (extra_vars) are required, they must be passed via POST data, with extra_vars given as a YAML or JSON string and escaped parentheses.`

I don’t specifically see anything about webhooks in the API, but I suspect the payload may need to be formatted specially.

Looking at [25. Working with Webhooks — Ansible AWX community documentation](https://ansible.readthedocs.io/projects/awx/en/latest/userguide/webhooks.html#payload-output) though, it seems like the entire payload is considered an extra\_vars variable. So, it seems the best you can do is `{"drink": "coffee"}` and it will be exposed to the playbook as

```json
"awx_webhook_payload": {
  "drink": "coffee"
}

```

This is probably by design as a security conscious decision, so that webhooks aren’t able to intentionally hijack playbook behavior. Instead, you would design your webhooked playbooks around expected payload nested vars. This might also be related to why AWX doesn’t allow jinja in extra\_vars by default.

---

<div class="post-metadata">

**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\
**Post date:** [April 13, 2024, 6:34am UTC](https://forum.ansible.com/t/extra-vars-to-webhooks-in-awx/4926/3 "2024-04-13T06:34:58Z")

</div>

> [@Denney-tech](#):
>
> it seems like the entire payload is considered an extra\_vars variable. So, it seems the best you can do is `{"drink": "coffee"}`

Indeed, also demonstrated by `hackby` in my example above.

Yes, sounds legitimate, and that’s the conclusion I arrived at. Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [May 13, 2024, 6:35am UTC](https://forum.ansible.com/t/extra-vars-to-webhooks-in-awx/4926/4 "2024-05-13T06:35:48Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.