fix(webhooks): fail an Ashby webhook delete that returns success:false

Ashby returns what would be a 4XX elsewhere as HTTP 200 with
`success: false` — its own docs state this explicitly. `deleteSubscription`
branched on `ashbyResponse.ok`, so every rejected delete logged
"Successfully deleted Ashby webhook subscription <id>" and never threw in
strict mode. Sim then dropped its own row while the subscription stayed
live in Ashby, and since there is no `webhook.list` endpoint the orphan
cannot be enumerated afterwards.

Check `success` the way `createSubscription` already does, and treat
`webhook_not_found` as already-removed rather than an error — that is the
shape an unknown id comes back in, not a 404.

An absent `success` field stays a success here, unlike on create: teardown
runs on the undeploy path, and failing closed on an undocumented response
shape would wedge cleanup.

Also corrects two trigger-surface details against the API reference: the
setup text said the webhook is created when you save the trigger (it is
created on deploy), and the jobCreate `employmentType` description omitted
the documented `Temporary` value.

Author: waleedlatif1

apps/sim/lib/webhooks/providers/ashby.test.ts

@@ -194,6 +194,56 @@ describe('ashbyHandler', () => {
     })
   })
 
+  describe('deleteSubscription', () => {
+    const realFetch = globalThis.fetch
+    afterEach(() => {
+      globalThis.fetch = realFetch
+    })
+
+    const ctx = (strict: boolean) =>
+      ({
+        requestId: 'req-1',
+        strict,
+        webhook: {
+          id: 'wh-1',
+          providerConfig: { apiKey: 'k', externalId: 'ext-1' },
+        },
+      }) as never
+
+    const respondWith = (body: unknown, status = 200) => {
+      globalThis.fetch = vi.fn().mockResolvedValue(
+        new Response(JSON.stringify(body), {
+          status,
+          headers: { 'content-type': 'application/json' },
+        })
+      ) as never
+    }
+
+    it('treats a 200 carrying success:false as a failed delete', async () => {
+      // Ashby returns what would be a 4XX as HTTP 200. Branching on
+      // response.ok alone reported the leak as a successful cleanup.
+      respondWith({ success: false, errors: [{ message: 'missing_endpoint_permission' }] })
+      await expect(ashbyHandler.deleteSubscription?.(ctx(true))).rejects.toThrow(
+        /missing_endpoint_permission/
+      )
+    })
+
+    it('stays non-fatal for a failed delete when not strict', async () => {
+      respondWith({ success: false, errors: [{ message: 'missing_endpoint_permission' }] })
+      await expect(ashbyHandler.deleteSubscription?.(ctx(false))).resolves.toBeUndefined()
+    })
+
+    it('treats an already-removed webhook as done even in strict mode', async () => {
+      respondWith({ success: false, errors: ['webhook_not_found'] })
+      await expect(ashbyHandler.deleteSubscription?.(ctx(true))).resolves.toBeUndefined()
+    })
+
+    it('accepts a successful delete', async () => {
+      respondWith({ success: true, results: { webhookId: 'ext-1' } })
+      await expect(ashbyHandler.deleteSubscription?.(ctx(true))).resolves.toBeUndefined()
+    })
+  })
+
   describe('extractIdempotencyId', () => {
     it('derives a stable key from application id + updatedAt', () => {
       const body = {

apps/sim/lib/webhooks/providers/ashby.ts

@@ -340,26 +340,39 @@ export const ashbyHandler: WebhookProviderHandler = {
         body: JSON.stringify({ webhookId: externalId }),
       })
 
-      if (ashbyResponse.ok) {
-        await ashbyResponse.body?.cancel()
+      const responseBody = (await ashbyResponse.json().catch(() => ({}))) as Record<string, unknown>
+
+      /**
+       * Ashby returns what would be a 4XX elsewhere as HTTP 200 with
+       * `success: false`, so the status alone cannot separate a completed
+       * delete from a rejected one. Branching on `ashbyResponse.ok` reported
+       * every rejection as a successful cleanup while Sim dropped its own row
+       * — and with no `webhook.list` endpoint, an orphan left behind that way
+       * cannot be enumerated afterwards.
+       *
+       * Unlike `createSubscription`, an absent `success` field is treated as
+       * success rather than failure: teardown runs on the undeploy path, and
+       * failing closed on an unparseable body would wedge cleanup on a
+       * response shape Ashby does not document.
+       */
+      const rejected = !ashbyResponse.ok || responseBody.success === false
+      const errorMessage = ashbyErrorMessage(responseBody, `HTTP ${ashbyResponse.status}`)
+
+      if (!rejected) {
         logger.info(
           `[${ctx.requestId}] Successfully deleted Ashby webhook subscription ${externalId}`
         )
-      } else if (ashbyResponse.status === 404) {
-        await ashbyResponse.body?.cancel()
+      } else if (ashbyResponse.status === 404 || /webhook_not_found/i.test(errorMessage)) {
         logger.info(
           `[${ctx.requestId}] Ashby webhook ${externalId} not found during deletion (already removed)`
         )
       } else {
-        const responseBody = await ashbyResponse.json().catch(() => ({}))
         logger.warn(
-          `[${ctx.requestId}] Failed to delete Ashby webhook (non-fatal): ${ashbyResponse.status}`,
-          { response: responseBody }
+          `[${ctx.requestId}] Failed to delete Ashby webhook (non-fatal): ${errorMessage}`,
+          { status: ashbyResponse.status, response: responseBody }
         )
         if (ctx.strict) {
-          throw new Error(
-            `Failed to delete Ashby webhook: ${ashbyErrorMessage(responseBody, `HTTP ${ashbyResponse.status}`)}`
-          )
+          throw new Error(`Failed to delete Ashby webhook: ${errorMessage}`)
         }
       }
     } catch (error) {

apps/sim/triggers/ashby/utils.ts

@@ -43,9 +43,9 @@ export function isAshbyEventMatch(triggerId: string, action: string): boolean {
  */
 export function ashbySetupInstructions(eventType: string): string {
   const instructions = [
-    'Enter your Ashby API Key above. You can find your API key in Ashby at <strong>Settings &gt; API Keys</strong>.',
-    `The webhook for <strong>${eventType}</strong> events will be automatically created in Ashby when you save the trigger.`,
-    'The webhook will be automatically deleted if you remove this trigger.',
+    'Enter your Ashby API Key above. You can find your API key in Ashby at <strong>Settings &gt; API Keys</strong>. It needs the <strong>apiKeysWrite</strong> permission.',
+    `The webhook for <strong>${eventType}</strong> events is created in Ashby when you deploy the workflow, not when you save the trigger.`,
+    'The webhook is deleted from Ashby when you remove this trigger and redeploy.',
   ]
 
   return instructions
@@ -275,7 +275,7 @@ export function buildJobCreateOutputs(): Record<string, TriggerOutput> {
       status: { type: 'string', description: 'Job status (Open, Closed, Draft, Archived)' },
       employmentType: {
         type: 'string',
-        description: 'Employment type (FullTime, PartTime, Intern, Contract)',
+        description: 'Employment type (FullTime, PartTime, Intern, Contract, Temporary)',
       },
     },
   } as Record<string, TriggerOutput>