Overview

Add CLI support for Webhooks including webhook configuration, deliveries, and pings using the App Store Connect API. This enables full management of webhook subscriptions and monitoring from the CLI with JSON-first output and explicit flags.

Scope

Primary resources from the OpenAPI spec:

• webhooks (GET list/instance, POST create, PATCH update, DELETE)
• webhookDeliveries (POST create, GET via webhook relationship)
• webhookPings (POST create)
• App relationships: apps/{id}/webhooks

Endpoints:

• GET /v1/webhooks/{id}
• POST /v1/webhooks
• PATCH /v1/webhooks/{id}
• DELETE /v1/webhooks/{id}
• GET /v1/webhooks/{id}/deliveries
• POST /v1/webhookDeliveries
• POST /v1/webhookPings
• GET /v1/apps/{id}/webhooks

Proposed CLI

Top-level group:

• asc webhooks <subcommand> [flags]

Subcommands (all support list/get/create/update/delete unless noted):

• webhooks (list/get/create/update/delete)
• webhooks deliveries (list/get via webhook)
• webhooks ping (create test ping)

Examples:

• asc webhooks list --app APP_ID
• asc webhooks get --webhook-id WEBHOOK_ID
• asc webhooks create --app APP_ID --url https://example.com/webhook --secret secret123 --events SUBSCRIPTION.CREATED,SUBSCRIPTION.UPDATED
• asc webhooks update --webhook-id WEBHOOK_ID --url https://new-url.com/webhook --enabled false
• asc webhooks delete --webhook-id WEBHOOK_ID --confirm
• asc webhooks deliveries --webhook-id WEBHOOK_ID
• asc webhooks ping --webhook-id WEBHOOK_ID

Flag patterns

Common:

• --app, --output, --pretty, --limit, --next, --paginate
• --confirm for destructive operations

Resource-specific examples:

• --webhook-id, --url, --secret, --enabled
• --events (comma-separated list of event types)
• --delivery-id (for delivery operations)

Output

• JSON minified by default
• --pretty for JSON
• --output table/markdown for list commands

Acceptance criteria

• Commands appear in asc --help and asc webhooks --help
• CRUD works for webhooks
• Webhook deliveries list/get works
• Webhook ping create works
• App relationship works
• Pagination flags work (--paginate, --next, --limit)
• Delete requires --confirm
• JSON-first output matches existing conventions
• Table and markdown output for list commands
• Event filtering/specification works correctly

Tests

• Unit tests for command flag validation and error cases
• HTTP client tests for list/get/create/update/delete
• Output tests for table/markdown
• Delivery and ping tests
• App relationship tests

Implementation notes

• Add cmd/webhooks*.go and internal/asc/client_webhooks*.go
• Add output helpers in internal/asc/output_webhooks.go
• Register command in cmd/root.go
• Add resource type constants in internal/asc/client_types.go
• Follow patterns in cmd/apps.go, cmd/subscriptions.go, and output helpers in internal/asc/output_*
• Note: Webhook deliveries are typically read-only (GET via relationship), pings are POST-only