Azure Logic Apps Standard – Unable to Retrieve HTTP Trigger Callback URL via Bicep/CLI with Private Endpoint Enabled

[piy49]

I’m trying to confirm whether the behavior I’m seeing is a platform limitation of Azure Logic Apps Standard (single-tenant) when used with Private Endpoints, rather than a deployment or permissions issue.

Environment
Logic App Type: Standard (single-tenant)
Trigger: HTTP – When an HTTP request is received
Networking:
Private Endpoint enabled
Public network access disabled
Accessible only from within VNet
Deployment:
ZIP deployment via Azure DevOps pipeline
Workflow deploys successfully
Trigger executes correctly when invoked from inside the VNet

Problem:-
As part of CI/CD, I need to programmatically retrieve the HTTP trigger callback URL so it can be stored in Key Vault or passed to downstream systems.

However, all automation approaches fail with:

ERROR: Not Found
Failed to retrieve callback URL
What I’ve Tried

The following methods all return 404 / Not Found, despite the workflow and trigger existing and functioning correctly:
az webapp workflow trigger list-callback-url

az rest calls to:

.../hostruntime/runtime/webhooks/workflow/api/management/workflows/{workflow}/triggers/{trigger}/listCallbackUrl
ARM / Bicep listCallbackUrl()
Multiple API versions
Delays for app warm-up and workflow execution
Current Status
✅ Workflow exists
✅ Trigger fires successfully
✅ HTTP endpoint works from داخل VNet
❌ Callback URL cannot be retrieved via ARM / CLI / REST

Questions
1)- Is retrieving HTTP trigger callback URLs via ARM/CLI unsupported by design for Logic Apps Standard when:
Private Endpoint is enabled
Public network access is disabled
2)- If this is supported, could you please provide:
The correct approach to retrieve the callback URL
Any required configuration or networking considerations
3)- Is there a recommended pattern for securely exposing or storing the callback URL in private-only environments?
Additional Request

If possible, I would also appreciate an example of how to retrieve the callback URL using Azure Bicep, or confirmation that this scenario is not supported.