Webhook events and payloads

Learn about when each webhook event occurs and what the payload contains.

In this article

About webhook events and payloads

You can create webhooks that subscribe to the events listed on this page. To limit the number of HTTP requests to your server, you should only subscribe to the specific events that you plan on handling. For more information, see Creating webhooks.

Each webhook event on this page includes a description of the webhook properties for that event. If the event has multiple actions, the properties corresponding to each action are included.

Each event is only available to specific types of webhooks. For example, an organization webhook can subscribe to the team event, but a repository webhook cannot. The description of each webhook event lists the availability for that event. For more information, see Types of webhooks.

The sender property

Most webhook payloads include a sender property identifying the user who triggered the event. Sometimes GitHub can't resolve a specific user, for example when an event comes from an internal process rather than a person, or when the triggering action has no associated user. For some events, such as check_run and check_suite, this includes actions with no Git push or authenticated API actor.

In these cases, sender is populated with the ghost user, a placeholder account whose login is ghost and whose id isn't tied to a real, current user. Don't assume sender always identifies the person who caused an event, and account for the ghost user in any security or business logic that relies on it.

Payload cap

Payloads are capped at 25 MB. If an event generates a larger payload, GitHub will not deliver a payload for that webhook event. This may happen, for example, on a create event if many branches or tags are pushed at once. We suggest monitoring your payload size to ensure delivery.

Delivery headers

HTTP POST payloads that are delivered to your webhook's configured URL endpoint will contain several special headers:

  • X-GitHub-Hook-ID: The unique identifier of the webhook.
  • X-GitHub-Event: The name of the event that triggered the delivery.
  • X-GitHub-Delivery: A globally unique identifier (GUID) to identify the event.
  • X-Hub-Signature: This header is sent if the webhook is configured with a secret. This is the HMAC hex digest of the request body, and is generated using the SHA-1 hash function and the secret as the HMAC key. X-Hub-Signature is provided for compatibility with existing integrations. We recommend that you use the more secure X-Hub-Signature-256 instead.
  • X-Hub-Signature-256: This header is sent if the webhook is configured with a secret. This is the HMAC hex digest of the request body, and is generated using the SHA-256 hash function and the secret as the HMAC key. For more information, see Validating webhook deliveries.
  • User-Agent: This header will always have the prefix GitHub-Hookshot/.
  • X-GitHub-Hook-Installation-Target-Type: The type of resource where the webhook was created.
  • X-GitHub-Hook-Installation-Target-ID: The unique identifier of the resource where the webhook was created.

To see what each header might look like in a webhook payload, see Example webhook delivery.

Example webhook delivery

You can choose to have payloads delivered in JSON format (application/json) or as URL-encoded data (x-www-form-urlencoded). Following is an example of a webhook POST request that uses the JSON format.

> POST /payload HTTP/1.1

> X-GitHub-Delivery: 72d3162e-cc78-11e3-81ab-4c9367dc0958
> X-Hub-Signature: sha1=7d38cdd689735b008b3c702edd92eea23791c5f6
> X-Hub-Signature-256: sha256=d57c68ca6f92289e6987922ff26938930f6e66a2d161ef06abdf1859230aa23c
> User-Agent: GitHub-Hookshot/044aadd
> Content-Type: application/json
> Content-Length: 6615
> X-GitHub-Event: issues
> X-GitHub-Hook-ID: 292430182
> X-GitHub-Hook-Installation-Target-ID: 79929171
> X-GitHub-Hook-Installation-Target-Type: repository

> {
>   "action": "opened",
>   "issue": {
>     "url": "https://api.github.com/repos/octocat/Hello-World/issues/1347",
>     "number": 1347,
>     ...
>   },
>   "repository" : {
>     "id": 1296269,
>     "full_name": "octocat/Hello-World",
>     "owner": {
>       "login": "octocat",
>       "id": 1,
>       ...
>     },
>     ...
>   },
>   "sender": {
>     "login": "octocat",
>     "id": 1,
>     ...
>   }
> }

branch_protection_configuration

This event occurs when there is a change to branch protection configurations for a repository. For more information, see "About protected branches." For information about using the APIs to manage branch protection rules, see "Branch protection rule" in the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

Availability for branch_protection_configuration

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for branch_protection_configuration

All branch protections were disabled for a repository.

Webhook request body parameters
action string Required

Value: disabled

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

branch_protection_rule

This event occurs when there is activity relating to branch protection rules. For more information, see "About protected branches." For information about the APIs to manage branch protection rules, see the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

Availability for branch_protection_rule

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for branch_protection_rule

A branch protection rule was created.

Webhook request body parameters
action string Required

Value: created

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

rule object Required

The branch protection rule. Includes a name and all the branch protection settings applied to branches that match the name. Binary settings are boolean. Multi-level configurations are one of off, non_admins, or everyone. Actor and build lists are arrays of strings.

sender object Required

A GitHub user.

bypass_request_secret_scanning

This event occurs when there is activity related to a user's request to bypass secret scanning push protection.

For more information, see "Enabling delegated bypass for push protection."

To subscribe to this event, a GitHub App must have at least read-level access for the "Secret scanning alerts" repository permission.

Note: Delegated bypass for push protection is currently in public preview and subject to change.

Availability for bypass_request_secret_scanning

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for bypass_request_secret_scanning

A secret scanning push protection bypass request was cancelled.

Webhook request body parameters
action string Required

Value: cancelled

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

exemption_request object Required

A request from a user to be exempted from a set of rules.

sender object Required

A GitHub user.

check_run

This event occurs when there is activity relating to a check run. For information about check runs, see "Getting started with the Checks API." For information about the APIs to manage check runs, see the GraphQL API documentation or "Check Runs" in the REST API documentation.

For activity relating to check suites, use the check-suite event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" repository permission. To receive the rerequested and requested_action event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the created and completed event types in repositories.

The API only looks for pushes in the repository where the check run was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

Availability for check_run

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for check_run

A check run was completed, and a conclusion is available.

Webhook request body parameters
action string

Value: completed

check_run object Required

A check performed on the code of a given code change

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

check_suite

This event occurs when there is activity relating to a check suite. For information about check suites, see "Getting started with the Checks API." For information about the APIs to manage check suites, see the GraphQL API documentation or "Check Suites" in the REST API documentation.

For activity relating to check runs, use the check_run event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" permission. To receive the requested and rerequested event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the completed event types in repositories.

The API only looks for pushes in the repository where the check suite was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

Availability for check_suite

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for check_suite

All check runs in a check suite have completed, and a conclusion is available.

Webhook request body parameters
action string Required

Value: completed

check_suite object Required
enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

code_scanning_alert

This event occurs when there is activity relating to code scanning alerts in a repository. For more information, see "About code scanning" and "About code scanning alerts." For information about the API to manage code scanning, see "Code scanning" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Code scanning alerts" repository permission.

Availability for code_scanning_alert

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for code_scanning_alert

A previously created code scanning alert appeared in another branch. This can happen when a branch is merged into or created from a branch with a pre-existing code scanning alert.

Webhook request body parameters
action string Required

Value: appeared_in_branch

alert object Required

The code scanning alert involved in the event.

commit_oid string Required

The commit SHA of the code scanning alert. When the action is reopened_by_user or closed_by_user, the event was triggered by the sender and this value will be empty.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

ref string Required

The Git reference of the code scanning alert. When the action is reopened_by_user or closed_by_user, the event was triggered by the sender and this value will be empty.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

commit_comment

This event occurs when there is activity relating to commit comments. For more information about commit comments, see "Commenting on a pull request." For information about the APIs to manage commit comments, see the GraphQL API documentation or "Commit comments" in the REST API documentation.

For activity relating to comments on pull request reviews, use the pull_request_review_comment event. For activity relating to issue comments, use the issue_comment event. For activity relating to discussion comments, use the discussion_comment event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

Availability for commit_comment

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for commit_comment

Someone commented on a commit.

Webhook request body parameters
action string Required

The action performed. Can be created.

Value: created

comment object Required

The commit comment resource.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

create

This event occurs when a Git branch or tag is created.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

Notes:

  • This event will not occur when more than three tags are created at once.
  • Payloads are capped at 25 MB. If an event generates a larger payload, GitHub will not deliver a payload for that webhook event. This may happen, for example, if many branches or tags are pushed at once. We suggest monitoring your payload size to ensure delivery.

Availability for create

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for create

Webhook request body parameters
description string or null Required

The repository's current description.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

master_branch string Required

The name of the repository's default branch (usually main).

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

pusher_type string Required

The pusher type for the event. Can be either user or a deploy key.

ref