{"version":"2.1.63","anchor":"http-hooks-now-functional","canonical_anchor":"http-hooks-now-functional","heading":"HTTP Hooks (Now Functional)","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.63\/e\/http-hooks-now-functional","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.63","markdown":"### HTTP Hooks (Now Functional)\n\n**What**\n\nHTTP hooks, previously stubbed with \"HTTP hooks are not yet supported,\" are now fully implemented and operational.\n\n**Usage**\n\n`{ \"hooks\": { \"PostToolUse\": [{ \"matcher\": \"Write\", \"hooks\": [{ \"type\": \"http\", \"url\": \"https:\/\/hooks.example.com\/on-write\", \"headers\": { \"Authorization\": \"Bearer $MY_TOKEN\" }, \"allowedEnvVars\": [\"MY_TOKEN\"] }] }] } }` **Details** - Sends POST requests with hook input as JSON body - Supports environment variable interpolation in headers via `$VAR_NAME` or `${VAR_NAME}` syntax - SSRF protection: private\/link-local addresses are blocked; loopback (127.0.0.1, ::1) is allowed for local development - New managed setting `allowedHttpHookUrls` for organization-level URL allowlisting with wildcard support (e.g., `\"https:\/\/hooks.example.com\/*\"`) - New managed setting `httpHookAllowedEnvVars` restricts which environment variables hooks can interpolate, intersecting with per-hook `allowedEnvVars` - Responses must be valid JSON **Evidence** HTTP hook execution code (search for `\"Hooks: HTTP hook POST to\"`, `\"ERR_HTTP_HOOK_BLOCKED_ADDRESS\"`, `\"allowedHttpHookUrls\"`)"}