## Issue description I would like the API key, for example, to be hidden within the webhook URL. Unfortunately, the Terraform configuration isn't working; despite using `url_variables`, the full URL remains visible. I'm using `gitlabhq/gitlab` terraform provider version 19.1.0. ### Terraform resource ```terraform resource "gitlab_project" "sample_project" { name = "webhook-test" } resource "gitlab_project_hook" "secret_hook" { name = "secret hook" project = gitlab_project.sample_project.id url = "https://webhook.site/160f7c5e-47ec-4434-a525-3e6829cfba80" push_events = false job_events = true url_variables = [{ key = "hidden" value = "160f7c5e-47ec-4434-a525-3e6829cfba80" }] } ``` ### terraform applay ```shell terraform apply gitlab_project.sample_project: Refreshing state... [id=2] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # gitlab_project_hook.secret_hook will be created + resource "gitlab_project_hook" "secret_hook" { + alert_status = (known after apply) + branch_filter_strategy = (known after apply) + confidential_issues_events = false + confidential_note_events = false + custom_webhook_template = (known after apply) + deployment_events = false + description = (known after apply) + disabled_until = (known after apply) + emoji_events = false + enable_ssl_verification = true + feature_flag_events = false + hook_id = (known after apply) + id = (known after apply) + issues_events = false + job_events = true + merge_requests_events = false + milestone_events = false + name = "secret hook" + note_events = false + pipeline_events = false + project = "2" + project_id = (known after apply) + push_events = false + push_events_branch_filter = (known after apply) + releases_events = false + repository_update_events = (known after apply) + resource_access_token_events = false + resource_deploy_token_events = false + signing_token_present = (known after apply) + tag_push_events = false + token = (sensitive value) + url = "https://webhook.site/160f7c5e-47ec-4434-a525-3e6829cfba80" + url_variables = (sensitive value) + vulnerability_events = false + wiki_page_events = false } Plan: 1 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes gitlab_project_hook.secret_hook: Creating... gitlab_project_hook.secret_hook: Creation complete after 0s [id=2:12] Apply complete! Resources: 1 added, 0 changed, 0 destroyed. ``` The `value` from the `url_variables` was not substituted into the `url` using the `key`. {width="900" height="289"} {width="900" height="490"} I tried to use key in the url directly but I got error: Invalid url given. ### Terraform resource ```terraform resource "gitlab_project" "sample_project" { name = "webhook-test" } resource "gitlab_project_hook" "secret_hook" { name = "secret hook" project = gitlab_project.sample_project.id url = "https://webhook.site/{hidden}" push_events = false job_events = true url_variables = [{ key = "hidden" value = "160f7c5e-47ec-4434-a525-3e6829cfba80" }] } ``` ### terraform applay ```shell terraform apply gitlab_project.sample_project: Refreshing state... [id=2] gitlab_project_hook.secret_hook: Refreshing state... [id=2:12] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: -/+ destroy and then create replacement Terraform will perform the following actions: # gitlab_project_hook.secret_hook must be replaced -/+ resource "gitlab_project_hook" "secret_hook" { ~ alert_status = "executable" -> (known after apply) ~ branch_filter_strategy = "wildcard" -> (known after apply) ~ custom_webhook_template = null -> (known after apply) ~ description = null -> (known after apply) + disabled_until = (known after apply) ~ hook_id = 12 -> (known after apply) ~ id = "2:12" -> (known after apply) name = "secret hook" ~ project_id = 2 -> (known after apply) ~ push_events_branch_filter = null -> (known after apply) ~ repository_update_events = false -> (known after apply) ~ signing_token_present = false -> (known after apply) + token = (sensitive value) ~ url = "https://webhook.site/160f7c5e-47ec-4434-a525-3e6829cfba80" -> "https://webhook.site/{hidden}" # forces replacement # (21 unchanged attributes hidden) } Plan: 1 to add, 0 to change, 1 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes gitlab_project_hook.secret_hook: Destroying... [id=2:12] gitlab_project_hook.secret_hook: Destruction complete after 0s gitlab_project_hook.secret_hook: Creating... ╷ │ Error: Error creating GitLab project hook │ │ with gitlab_project_hook.secret_hook, │ on main.tf line 5, in resource "gitlab_project_hook" "secret_hook": │ 5: resource "gitlab_project_hook" "secret_hook" { │ │ POST http://localhost:8080/api/v4/projects/2/hooks: 422 {error: Invalid url given} ╵ ``` ## REST API Wrokaround I was able to perform this configuration using the REST API, so I assume the problem lies with the implementation in the provider. ### Add webhook insecure ```shell curl -X POST -H "PRIVATE-TOKEN: XXX" -H "Content-Type: application/json" https://gitlab.com/api/v4/projects/2/hooks -d '{"url": "https://webhook.site/160f7c5e-47ec-4434-a525-3e6829cfba80","name":"Webhook test from API"}' {"id":10,"url":"https://webhook.site/160f7c5e-47ec-4434-a525-3e6829cfba80","name":"Webhook test from API","description":null,"created_at":"2026-07-15T09:38:19.121Z","push_events":true,"tag_push_events":false,"merge_requests_events":false,"repository_update_events":false,"enable_ssl_verification":true,"alert_status":"executable","disabled_until":null,"url_variables":[],"push_events_branch_filter":null,"branch_filter_strategy":"wildcard","custom_webhook_template":null,"custom_headers":[],"token_present":false,"signing_token_present":false,"project_id":2,"issues_events":false,"confidential_issues_events":false,"note_events":false,"confidential_note_events":null,"pipeline_events":false,"wiki_page_events":false,"deployment_events":false,"feature_flag_events":false,"job_events":false,"releases_events":false,"milestone_events":false,"emoji_events":false,"resource_access_token_events":false,"resource_deploy_token_events":false,"vulnerability_events":false}% ``` ### Add url variable ```shell curl -X PUT -H "PRIVATE-TOKEN: XXX" -H "Content-Type: application/json" https://gitlab.com/api/v4/projects/2/hooks/10/url_variables/hidden -d '{"value":"160f7c5e-47ec-4434-a525-3e6829cfba80"}' ``` ### Update url ```shell curl -X PUT -H "PRIVATE-TOKEN: XXX" -H "Content-Type: application/json" https://gitlab.com/api/v4/projects/2/hooks/10 -d '{"url":"https://webhook.site/{hidden}"}' {"id":10,"url":"https://webhook.site/{hidden}","name":"Webhook test from API","description":null,"created_at":"2026-07-15T09:38:19.121Z","push_events":true,"tag_push_events":false,"merge_requests_events":false,"repository_update_events":false,"enable_ssl_verification":true,"alert_status":"executable","disabled_until":null,"url_variables":[{"key":"hidden"}],"push_events_branch_filter":null,"branch_filter_strategy":"wildcard","custom_webhook_template":null,"custom_headers":[],"token_present":false,"signing_token_present":false,"project_id":2,"issues_events":false,"confidential_issues_events":false,"note_events":false,"confidential_note_events":null,"pipeline_events":false,"wiki_page_events":false,"deployment_events":false,"feature_flag_events":false,"job_events":false,"releases_events":false,"milestone_events":false,"emoji_events":false,"resource_access_token_events":false,"resource_deploy_token_events":false,"vulnerability_events":false}% ``` {width="900" height="246"}