Issue Summary

This issue is related to and extends the fix applied in AUTO-2207 and AUTO-2211, where the webhook secret exposure was resolved on the public API, but the internal gateway endpoint was missed. 

Jira's internal automation config-read API returns the incoming webhook rule secret in cleartext in the tags[] array, even though the same secret is properly masked in trigger.value.webhookToken in the same response. The fix from AUTO-2207 and AUTO-2211 didn't cover this endpoint.

Affected endpoint (internal, used by the admin UI, not the public REST API): GET /gateway/api/automation/internal-api/jira/{cloudId}/pro/rest/GLOBAL/rule/{ruleId}

This endpoint is reachable by automation rule admins below site-admin level, or by a service account token with that access.

Steps to Reproduce

1. Create or identify an incoming webhook automation rule in Jira Cloud
2. As a user with automation admin access (or a service account token with that access), call: GET /gateway/api/automation/internal-api/jira/{cloudId}/pro/rest/GLOBAL/rule/{ruleId}
3. Inspect the response body and locate the tags[] array
4. Find the entry with tagType: WEBHOOK_TOKEN - the value comes back in cleartext
5. Compare with trigger.value.webhookToken in the same response, that field is properly masked

Expected Results

The WEBHOOK_TOKEN value in tags[] should be masked, the same way trigger.value.webhookToken is already masked in the same response.

Actual Results

The tags[] array has an entry with tagType: WEBHOOK_TOKEN returning the full webhook secret in cleartext. This happens even for newly created or disabled rules. The secret shows up twice in the response - masked in trigger.value.webhookToken, exposed in tags[].

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available.