# Webhook selection shows full endpoint URL (incl. secrets) – show host only

**URL:** <https://community.zammad.org/t/webhook-selection-shows-full-endpoint-url-incl-secrets-show-host-only/21458>\
**Category:** Feature requests\
**Tags:** missing-template\
**Created:** [November 5, 2026, 2:06pm UTC](https://community.zammad.org/t/webhook-selection-shows-full-endpoint-url-incl-secrets-show-host-only/21458 "2026-11-05T14:06:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![swk1986](https://community.zammad.org/user_avatar/community.zammad.org/swk1986/32/12156_2.png) [@swk1986](https://community.zammad.org/u/swk1986)\
**Post date:** [November 5, 2026, 2:06pm UTC](https://community.zammad.org/t/webhook-selection-shows-full-endpoint-url-incl-secrets-show-host-only/21458/1 "2026-11-05T14:06:53Z")

</div>

Wherever a webhook can be selected (triggers, schedulers), it is shown as `Name (Endpoint)`. Many endpoints carry secrets in the path or query (e.g. Teams/Slack/chat webhooks), so the full secret is visible to every admin editing a trigger, and on screenshots and shared screens. Long URLs also make the selection hard to read (see #6500).

 ![2026-11-05 13.18.29 ticket.henova.de 84aff7f57599](https://community.zammad.org/uploads/default/original/2X/0/05493d1bae1c642aab171aaf2b540108d5e5433f.png)

**Proposal:** show only the host of the endpoint.

File: `app/assets/javascripts/app/models/webhook.coffee`

Current:

```coffee
displayName: ->
  return @name if !@endpoint
  if @active is false
    return "#{@name} (#{@endpoint}) (#{App.i18n.translateInline('inactive')})"
  "#{@name} (#{@endpoint})"

```

Suggested:

```coffee
displayName: ->
  return @name if !@endpoint
  host = @endpointHost()
  label = if host then "#{@name} (#{host})" else @name
  if @active is false
    return "#{label} (#{App.i18n.translateInline('inactive')})"
  label

endpointHost: ->
  try
    new URL(@endpoint).host
  catch
    null

```

`URL.host` drops the scheme, path, query and any `user:pass@` part. Endpoints with placeholders such as `#{config.fqdn}` may fail to parse and then fall back to the name only.