Read-only API tokens no longer expose pipeline webhook URLs

Read-only API access tokens no longer return a pipeline’s webhook_url in REST and GraphQL responses. Previously, a read_only token created by someone with pipeline write access could still retrieve the webhook_url . Because that URL can be used to trigger builds, a token intended to be read-only could effectively grant write access.