Read-only API tokens no longer expose pipeline webhook URLs

Read-only API access tokens no longer return a pipeline's webhook_url in REST and GraphQL responses.

Previously, a read_only token created by someone with pipeline write access could still retrieve the webhook_url. Because that URL can be used to trigger builds, a token intended to be read-only could effectively grant write access.

Buildkite now checks both the token's scope and its creator's permissions, applying whichever is more restrictive.

This is a breaking change if you rely on reading a pipeline's webhook_url using a read-only token. Update that automation to use a token with pipeline write scope instead.

For more on token scopes, see the managing API tokens documentation.