HTTP Hooks (Now Functional) / Claude Code v2.1.63

What

HTTP hooks, previously stubbed with "HTTP hooks are not yet supported," are now fully implemented and operational.

Usage

{
  "hooks": {
    "PostToolUse": [{
      "matcher": "Write",
      "hooks": [{
        "type": "http",
        "url": "https://hooks.example.com/on-write",
        "headers": { "Authorization": "Bearer $MY_TOKEN" },
        "allowedEnvVars": ["MY_TOKEN"]
      }]
    }]
  }
}

Details

Sends POST requests with hook input as JSON body
Supports environment variable interpolation in headers via $VAR_NAME or ${VAR_NAME} syntax
SSRF protection: private/link-local addresses are blocked; loopback (127.0.0.1, ::1) is allowed for local development
New managed setting allowedHttpHookUrls for organization-level URL allowlisting with wildcard support (e.g., "https://hooks.example.com/*")
New managed setting httpHookAllowedEnvVars restricts which environment variables hooks can interpolate, intersecting with per-hook allowedEnvVars
Responses must be valid JSON

Evidence

HTTP hook execution code (search for "Hooks: HTTP hook POST to", "ERR_HTTP_HOOK_BLOCKED_ADDRESS", "allowedHttpHookUrls")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.