> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pawsql.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> PawSQL 是一个产品：Cloud 是公网部署形态，Engine / Optimizer / Auditor / Advisor / Patroller 是同一产品的组件与交付形态，不是彼此独立的产品。 / PawSQL is a single product: Cloud is the public deployment form, while Engine / Optimizer / Auditor / Advisor / Patroller are components and delivery forms of the same product, not separate products.
> 术语以站内术语表为准：SQL 审核对应英文 SQL Review，查询重写对应 Query Rewrite，索引推荐对应 Index Recommendation；英文内容统一用 Review，不用 Audit。 / Use the site glossary for terminology: 审核 is SQL Review, 重写 is Query Rewrite, 索引推荐 is Index Recommendation; English content uses Review, never Audit.
> 引用能力范围或版本支持时以对应页面为准；标注 unknown、或 status 非 published 的内容表示尚未经产品核实，不应作为事实引用。 / Cite capability scope and version support from the corresponding page; content marked unknown, or with a status other than published, is not yet product-verified and must not be cited as fact.

# GitLab Webhook callback

> Receive GitLab Push/Merge Request events, automatically extract changed SQL and trigger an audit.

**GitLab configuration**:
1. Create an SCM monitoring configuration in the PawSQL admin console to obtain the webhookToken
2. In GitLab project → Settings → Webhooks, fill in the URL:
   `{PAWSQL_SERVER}/api/v1/integrations/gitlab/webhook/{webhookToken}`
3. Check Push events and Merge request events

**Expected HTTP Headers**:
- `X-Gitlab-Event`: event type (push / merge_request)
- `X-Gitlab-Token`: secret token (optional)
- `X-Gitlab-Event-UUID`: unique event identifier

**Request Body**: GitLab Webhook Payload (JSON format), see the [GitLab Webhook documentation](https://docs.gitlab.com/ee/user/project/integrations/webhooks.html)




## OpenAPI

````yaml /openapi/pawsql-integration-en.yaml post /integrations/gitlab/webhook/{webhookToken}
openapi: 3.0.3
info:
  title: CI/CD Integration
  description: >
    CI/CD Integration APIs for external platforms (BlueKing, Coding, GitLab,
    etc.) to integrate SQL audit capabilities.


    ## Endpoint Categories


    - **SQL Audit Tasks**: create audit tasks, query audit results, look up
    workspaces

    - **Webhook Callbacks**: receive code change events pushed by
    GitLab/Coding/GitHub platforms to automatically trigger SQL audits


    ## Authentication


    SQL audit task endpoints do not require a userKey; the source platform is
    identified by `platformCode`.

    Webhook endpoints are verified through the `webhookToken` in the URL.


    ## Typical Integration Flow


    1. Create a workspace and audit rule template in the PawSQL admin console

    2. Call `/sql-audits/workspace-lookup` to look up the workspaceId and
    ruleTemplateId

    3. Call `POST /sql-audits` to create an audit task (passing SQL text or code
    change info)

    4. Poll `GET /sql-audits/{taskId}` for the audit result

    5. Or configure a Webhook to trigger audits automatically on code push
  version: 1.0.0
  contact:
    name: PawSQL Team
    url: https://pawsql.com
  license:
    name: PawSQL
    url: https://pawsql.com
servers:
  - url: /api/v1
    description: PawSQL Server
security: []
tags:
  - name: SQL Audit Tasks
    description: Creation and query of SQL audit tasks
  - name: GitLab Webhook
    description: GitLab Webhook callback
  - name: Coding Webhook
    description: Coding Webhook callback
  - name: GitHub Webhook
    description: GitHub Webhook callback
paths:
  /integrations/gitlab/webhook/{webhookToken}:
    post:
      tags:
        - GitLab Webhook
      summary: GitLab Webhook callback
      description: >
        Receive GitLab Push/Merge Request events, automatically extract changed
        SQL and trigger an audit.


        **GitLab configuration**:

        1. Create an SCM monitoring configuration in the PawSQL admin console to
        obtain the webhookToken

        2. In GitLab project → Settings → Webhooks, fill in the URL:
           `{PAWSQL_SERVER}/api/v1/integrations/gitlab/webhook/{webhookToken}`
        3. Check Push events and Merge request events


        **Expected HTTP Headers**:

        - `X-Gitlab-Event`: event type (push / merge_request)

        - `X-Gitlab-Token`: secret token (optional)

        - `X-Gitlab-Event-UUID`: unique event identifier


        **Request Body**: GitLab Webhook Payload (JSON format), see the [GitLab
        Webhook
        documentation](https://docs.gitlab.com/ee/user/project/integrations/webhooks.html)
      operationId: gitlabWebhook
      parameters:
        - name: webhookToken
          in: path
          required: true
          schema:
            type: string
          description: Webhook verification token
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              description: >-
                GitLab Webhook Payload, format per the official GitLab
                documentation
      responses:
        '200':
          description: Webhook processing result
          content:
            text/plain:
              schema:
                type: string
              examples:
                success:
                  value: Webhook processed successfully
                skipped:
                  value: No SQL changes detected

````