Nothing here is spelled out. This sink POSTs to a webhook URL but never returns the response body - a classic blind SSRF. Delivery is restricted to an allowlist, and the receipts you get back are terse. Build a method:
1) Confirm it fires. You cannot read the body, so prove the request leaves the box out-of-band - point it somewhere you can observe and check the Collector Log.
2) Get past the allowlist. The check only inspects how the authority starts; that is not the same as where the request actually goes.
3) Pivot inward and enumerate. Loopback services live on ports you have to find. Open, closed, and filtered ports each come back differently even through a blind sink - read the receipts. There are dead/decoy ports in the way.
4) Read the prize. Once you reach the internal admin service, think about how a blind hit can still surface its secret.