Register, refresh, and receive Jira Cloud dynamic webhooks via the REST API

Documented steps

1. POST https://your-domain.atlassian.net/rest/api/3/webhook with {"url":"https://your-app.example.com/webhook-received","webhooks":[{"events":["jira:issue_created","jira:issue_updated"],"jqlFilter":"project = PROJ"}]} — only Connect apps and OAuth 2.0 (3LO) apps may call this.
2. Supported dynamic events: jira:issue_created/updated/deleted, comment_created/updated/deleted, issue_property_set/deleted, sprint_created/updated/closed/deleted/started, jira:version_released/unreleased/created/moved/updated/merged/deleted.
3. jqlFilter supports only issueKey, project, issuetype, status, priority, assignee, reporter, issue.property, cf[id] (Epic field) with =, !=, IN, NOT IN.
4. Check per-entry results: {"webhookRegistrationResult":[{"createdWebhookId":1000},{"errors":[...]}]} — entries can succeed and fail independently.
5. List: GET /rest/api/3/webhook (paginated, default startAt=0 maxResults=100). Delete: DELETE /rest/api/3/webhook with {"webhookIds":[...]} (unknown ids ignored).
6. Webhooks expire 30 days after creation/refresh: PUT /rest/api/3/webhook/refresh with {"webhookIds":[...]} before expiry (extends 30 days; response has expirationDate). Expired hooks remain refreshable up to 3 months.
7. Alternative without app auth: admin-configured webhooks in Jira Administration — no refresh cycle, but requires site admin.
8. Auth: OAuth2 scopes read:jira-work + manage:jira-webhook (webhook CRUD is 403 for non-app callers); receiving an event also requires the scopes in the per-event table (e.g. jira:issue_created needs read:issue-details:jira).
9. Official docs: https://developer.atlassian.com/cloud/jira/platform/webhooks/ and https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-webhooks/