Webhook-Ereignisse und Webhook-Nutzlasten

Hier erfährst du, wann jedes Webhookereignis auftritt und was die Nutzlast enthält.

In diesem Artikel

Informationen zu Webhook-Ereignissen und -Nutzdaten

Du kannst Webhooks erstellen, die die auf dieser Seite aufgeführten Ereignisse abonnieren. Um die Anzahl von HTTP-Anforderungen an deinen Server zu begrenzen, solltest du nur die spezifischen Ereignisse abonnieren, die du behandeln möchtest. Weitere Informationen finden Sie unter Erstellen von Webhooks.

Jedes Webhook-Ereignis auf dieser Seite enthält eine Beschreibung der Webhook-Eigenschaften für dieses Ereignis. Wenn das Ereignis über mehrfache Aktionen verfügt, sind die den einzelnen Aktionen entsprechenden Eigenschaften enthalten.

Jedes Ereignis ist nur für bestimmte Webhook-Typen verfügbar. Beispielsweise kann ein team-Ereignis von einem Organisations-Webhook abonniert werden, nicht aber von einem Repository-Webhook. In der Beschreibung jedes Webhook-Ereignisses wird die Verfügbarkeit für dieses Ereignis angegeben. Weitere Informationen finden Sie unter Arten von Webhooks.

Die sender-Eigenschaft.

Die meisten Webhook-Nutzlasten enthalten eine sender Eigenschaft, die den Benutzer identifiziert, der das Ereignis ausgelöst hat. Manchmal GitHub kann ein bestimmter Benutzer nicht aufgelöst werden, z. B. wenn ein Ereignis von einem internen Prozess und nicht von einer Person stammt oder wenn die auslösende Aktion keinen zugehörigen Benutzer hat. Bei einigen Ereignissen, wie check_run und check_suite, schließt dies Aktionen ohne Git-Push oder authentifizierten API-Akteur ein.

In diesen Fällen wird sender mit dem ghost Benutzer ausgefüllt, einem Platzhalterkonto, dessen login``ghost ist und dessen id keinem echten, aktuellen Benutzer zugeordnet ist. Gehen Sie nicht davon aus, dass sender immer die Person identifiziert, die ein Ereignis verursacht hat, und berücksichtigen Sie den ghost Benutzer in jeder Sicherheits- oder Geschäftslogik, die darauf basiert.

Nutzdatenobergrenze

Nutzdaten sind auf 25 MB begrenzt. Wenn ein Ereignis eine größere Nutzdatenmenge generiert, übermittelt GitHub keine Nutzdaten für dieses Webhook-Ereignis. Dies kann beispielsweise bei einem create-Ereignis geschehen, wenn viele Branches oder Tags gleichzeitig verschoben werden. Es wird empfohlen, die Nutzlastgröße zu überwachen, um die Übermittlung sicherzustellen.

Lieferheader

HTTP-POST-Nutzlasten, die an den konfigurierten URL-Endpunkt deines Webhook übermittelt werden, enthalten mehrere spezielle Header:

  • X-GitHub-Hook-ID: Der eindeutige Bezeichner des Webhooks.
  • X-GitHub-Event: Der Name des Ereignisses, das die Zustellung ausgelöst hat.
  • X-GitHub-Delivery: Eine GUID (Globally Unique Identifier), um das Ereignis zu identifizieren.
  • X-Hub-Signature: Dieser Header wird gesendet, wenn der Webhook mit secret konfiguriert ist. Dies ist der HMAC-Hex-Digest des Anforderungstexts und wird mithilfe der SHA-1-Hashfunktion und des secret als HMAC key generiert. X-Hub-Signature wird aus Gründen der Kompatibilität mit bestehenden Integrationen bereitgestellt. Wir empfehlen, stattdessen die sicherere X-Hub-Signature-256 zu verwenden.
  • X-Hub-Signature-256: Dieser Header wird gesendet, wenn der Webhook mit secret konfiguriert ist. Dies ist der HMAC-Hex-Digest des Anforderungstexts und wird mithilfe der SHA-256-Hashfunktion und des secret als HMAC key generiert. Weitere Informationen finden Sie unter Validierung der Webhook-Lieferungen.
  • User-Agent: Diese Kopfzeile hat immer das Präfix GitHub-Hookshot/.
  • X-GitHub-Hook-Installation-Target-Type: Der Typ der Ressource, in der der Webhook erstellt wurde.
  • X-GitHub-Hook-Installation-Target-ID: Der eindeutige Bezeichner der Ressource, in der der Webhook erstellt wurde.

Informationen dazu, wie jeder Header in einer Webhook-Nutzlast aussehen kann, finden Sie unter Beispiel für eine Webhook-Zustellung.

Beispiel für die Webhook-Zustellung

Sie können auswählen, ob Nutzdaten im JSON-Format (application/json) oder als URL-codierte Daten (x-www-form-urlencoded) zugestellt werden sollen. Nachfolgend sehen Sie ein Beispiel für eine Webhook POST-Anforderung im JSON-Format.

> POST /payload HTTP/1.1

> X-GitHub-Delivery: 72d3162e-cc78-11e3-81ab-4c9367dc0958
> X-Hub-Signature: sha1=7d38cdd689735b008b3c702edd92eea23791c5f6
> X-Hub-Signature-256: sha256=d57c68ca6f92289e6987922ff26938930f6e66a2d161ef06abdf1859230aa23c
> User-Agent: GitHub-Hookshot/044aadd
> Content-Type: application/json
> Content-Length: 6615
> X-GitHub-Event: issues
> X-GitHub-Hook-ID: 292430182
> X-GitHub-Hook-Installation-Target-ID: 79929171
> X-GitHub-Hook-Installation-Target-Type: repository

> {
>   "action": "opened",
>   "issue": {
>     "url": "https://api.github.com/repos/octocat/Hello-World/issues/1347",
>     "number": 1347,
>     ...
>   },
>   "repository" : {
>     "id": 1296269,
>     "full_name": "octocat/Hello-World",
>     "owner": {
>       "login": "octocat",
>       "id": 1,
>       ...
>     },
>     ...
>   },
>   "sender": {
>     "login": "octocat",
>     "id": 1,
>     ...
>   }
> }

branch_protection_configuration

This event occurs when there is a change to branch protection configurations for a repository. For more information, see "About protected branches." For information about using the APIs to manage branch protection rules, see "Branch protection rule" in the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

Verfügbarkeit für branch_protection_configuration

  • Repositories
  • Organisationen
  • GitHub Apps

Webhook-Payload-Objekt für branch_protection_configuration

All branch protections were disabled for a repository.

Webhook-Anforderungstextparameter
action string Erforderlich

Wert: disabled

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Erforderlich

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Erforderlich

A GitHub user.

branch_protection_rule

This event occurs when there is activity relating to branch protection rules. For more information, see "About protected branches." For information about the APIs to manage branch protection rules, see the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

Verfügbarkeit für branch_protection_rule

  • Repositories
  • Organisationen
  • GitHub Apps

Webhook-Payload-Objekt für branch_protection_rule

A branch protection rule was created.

Webhook-Anforderungstextparameter
action string Erforderlich

Wert: created

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Erforderlich

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

rule object Erforderlich

The branch protection rule. Includes a name and all the branch protection settings applied to branches that match the name. Binary settings are boolean. Multi-level configurations are one of off, non_admins, or everyone. Actor and build lists are arrays of strings.

sender object Erforderlich

A GitHub user.

check_run

This event occurs when there is activity relating to a check run. For information about check runs, see "Getting started with the Checks API." For information about the APIs to manage check runs, see the GraphQL API documentation or "Check Runs" in the REST API documentation.

For activity relating to check suites, use the check-suite event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" repository permission. To receive the rerequested and requested_action event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the created and completed event types in repositories.

The API only looks for pushes in the repository where the check run was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

Verfügbarkeit für check_run

  • Repositories
  • Organisationen
  • GitHub Apps

Webhook-Payload-Objekt für check_run

A check run was completed, and a conclusion is available.

Webhook-Anforderungstextparameter
action string

Wert: completed

check_run object Erforderlich

A check performed on the code of a given code change

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Erforderlich

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Erforderlich

A GitHub user.

check_suite

This event occurs when there is activity relating to a check suite. For information about check suites, see "Getting started with the Checks API." For information about the APIs to manage check suites, see the GraphQL API documentation or "Check Suites" in the REST API documentation.

For activity relating to check runs, use the check_run event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" permission. To receive the requested and rerequested event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the completed event types in repositories.

The API only looks for pushes in the repository where the check suite was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

Verfügbarkeit für check_suite

  • Repositories
  • Organisationen
  • GitHub Apps

Webhook-Payload-Objekt für check_suite

All check runs in a check suite have completed, and a conclusion is available.

Webhook-Anforderungstextparameter
action string Erforderlich

Wert: completed

check_suite object Erforderlich
enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Erforderlich

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Erforderlich

A GitHub user.

code_scanning_alert

This event occurs when there is activity relating to code scanning alerts in a repository. For more information, see "About code scanning" and "About code scanning alerts." For information about the API to manage code scanning, see "Code scanning" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Code scanning alerts" repository permission.

Verfügbarkeit für code_scanning_alert

  • Repositories
  • Organisationen
  • GitHub Apps

Webhook-Payload-Objekt für code_scanning_alert

A previously created code scanning alert appeared in another branch. This can happen when a branch is merged into or created from a branch with a pre-existing code scanning alert.

Webhook-Anforderungstextparameter
action string Erforderlich

Wert: appeared_in_branch

alert object Erforderlich

The code scanning alert involved in the event.

commit_oid string Erforderlich

The commit SHA of the code scanning alert. When the action is reopened_by_user or closed_by_user, the event was triggered by the sender and this value will be empty.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

ref string Erforderlich

The Git reference of the code scanning alert. When the action is reopened_by_user or closed_by_user, the event was triggered by the sender and this value will be empty.

repository object Erforderlich

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Erforderlich

A GitHub user.

commit_comment

This event occurs when there is activity relating to commit comments. For more information about commit comments, see "Commenting on a pull request." For information about the APIs to manage commit comments, see the GraphQL API documentation or "Commit comments" in the REST API documentation.

For activity relating to comments on pull request reviews, use the pull_request_review_comment event. For activity relating to issue comments, use the issue_comment event. For activity relating to discussion comments, use the discussion_comment event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

Verfügbarkeit für commit_comment

  • Repositories
  • Organisationen
  • GitHub Apps

Webhook-Payload-Objekt für commit_comment

Someone commented on a commit.

Webhook-Anforderungstextparameter
action string Erforderlich

The action performed. Can be created.

Wert: created

comment object Erforderlich

The commit comment resource.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Erforderlich

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Erforderlich

A GitHub user.

create

This event occurs when a Git branch or tag is created.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

Notes:

  • This event will not occur when more than three tags are created at once.
  • Payloads are capped at 25 MB. If an event generates a larger payload, GitHub will not deliver a payload for that webhook event. This may happen, for example, if many branches or tags are pushed at once. We suggest monitoring your payload size to ensure delivery.

Verfügbarkeit für create