We currently set the webhook url, the dbGaP ID through environment variables, and the lookback days as a fixed value.
These should be set as arguments that the python script takes (eg with sys.argv). The webhook URL should still be called via the secret it is set through as it should not be publicly exposed.