Which statement is true about webhook URL authentication?

IBM Cloud Pak for AIOps supports multiple authentication methods for incoming webhook connections, including basic authentication. One of the documented methods for implementing basic authentication is to embed the credentials directly within the webhook URL. The supported format is https://:@:/. This allows external systems that support this URL format to securely connect and send data to the AIOps event manager. This method is explicitly provided as a configuration option when setting up a generic webhook integration.

B. Specification of additional Headers is not supported for authentication.

This is incorrect. The generic webhook configuration in IBM Cloud Pak for AIOps explicitly provides an option to add custom HTTP headers, which can be used for various purposes, including authentication with API keys or custom tokens.

C. Only Authorization HTTP request header is supported.

This is incorrect. While using the Authorization header for bearer tokens or basic authentication is supported, the platform also supports embedding credentials directly in the URL, as stated in the correct answer.

D. Basic authentication is not supported due to security constraints.

This is incorrect. Basic authentication is explicitly listed and supported as an authentication type for webhook connections in IBM Cloud Pak for AIOps, both through UI fields and by embedding credentials in the URL.

1. IBM Cloud Pak for AIOps 4.2.0 Documentation, "Defining incoming connections," section "Creating generic webhook connections."

Reference for Correct Answer (A) and Incorrect Answer (D): In Step 5 of the procedure, the documentation states: "Enter the Webhook URL for the generic webhook. If the webhook requires basic authentication, you can include the username and password in the Webhook URL. https://:@:/". This confirms that prepending credentials is a supported method for basic authentication.

Reference for Incorrect Answer (B): In the "Options (Optional)" part of the procedure, the documentation states: "Click Add header to add a custom request header." This confirms support for additional headers.

Reference for Incorrect Answer (C): The documentation provides multiple authentication methods in the UI, including "Basic authentication" (with username/password fields) and "Token authentication," in addition to the URL-based method, proving that the Authorization header is not the only supported mechanism.