This version of GitHub Enterprise Server was discontinued on 2025-04-03. No patch releases will be made, even for critical security issues. For better performance, improved security, and new features, upgrade to the latest version of GitHub Enterprise Server. For help with the upgrade, contact GitHub Enterprise support.

Webhook events and payloads

Learn about when each webhook event occurs and what the payload contains.

In this article

About webhook events and payloads

You can create webhooks that subscribe to the events listed on this page. To limit the number of HTTP requests to your server, you should only subscribe to the specific events that you plan on handling. For more information, see Creating webhooks.

Each webhook event on this page includes a description of the webhook properties for that event. If the event has multiple actions, the properties corresponding to each action are included.

Each event is only available to specific types of webhooks. For example, an organization webhook can subscribe to the team event, but a repository webhook cannot. The description of each webhook event lists the availability for that event. For more information, see Types of webhooks.

Payload cap

Payloads are capped at 25 MB. If an event generates a larger payload, GitHub will not deliver a payload for that webhook event. This may happen, for example, on a create event if many branches or tags are pushed at once. We suggest monitoring your payload size to ensure delivery.

Delivery headers

HTTP POST payloads that are delivered to your webhook's configured URL endpoint will contain several special headers:

  • X-GitHub-Hook-ID: The unique identifier of the webhook.
  • X-GitHub-Event: The name of the event that triggered the delivery.
  • X-GitHub-Delivery: A globally unique identifier (GUID) to identify the event.
  • X-GitHub-Enterprise-Version: The version of the GitHub Enterprise Server instance that sent the HTTP POST payload.
  • X-GitHub-Enterprise-Host: The hostname of the GitHub Enterprise Server instance that sent the HTTP POST payload.
  • X-Hub-Signature: This header is sent if the webhook is configured with a secret. This is the HMAC hex digest of the request body, and is generated using the SHA-1 hash function and the secret as the HMAC key. X-Hub-Signature is provided for compatibility with existing integrations. We recommend that you use the more secure X-Hub-Signature-256 instead.
  • X-Hub-Signature-256: This header is sent if the webhook is configured with a secret. This is the HMAC hex digest of the request body, and is generated using the SHA-256 hash function and the secret as the HMAC key. For more information, see Validating webhook deliveries.
  • User-Agent: This header will always have the prefix GitHub-Hookshot/.
  • X-GitHub-Hook-Installation-Target-Type: The type of resource where the webhook was created.
  • X-GitHub-Hook-Installation-Target-ID: The unique identifier of the resource where the webhook was created.

To see what each header might look like in a webhook payload, see Example webhook delivery.

Example webhook delivery

You can choose to have payloads delivered in JSON format (application/json) or as URL-encoded data (x-www-form-urlencoded). Following is an example of a webhook POST request that uses the JSON format.

> POST /payload HTTP/1.1

> X-GitHub-Delivery: 72d3162e-cc78-11e3-81ab-4c9367dc0958
> X-GitHub-Enterprise-Version: 2.15.0
> X-GitHub-Enterprise-Host: example.com
> X-Hub-Signature: sha1=7d38cdd689735b008b3c702edd92eea23791c5f6
> X-Hub-Signature-256: sha256=d57c68ca6f92289e6987922ff26938930f6e66a2d161ef06abdf1859230aa23c
> User-Agent: GitHub-Hookshot/044aadd
> Content-Type: application/json
> Content-Length: 6615
> X-GitHub-Event: issues
> X-GitHub-Hook-ID: 292430182
> X-GitHub-Hook-Installation-Target-ID: 79929171
> X-GitHub-Hook-Installation-Target-Type: repository

> {
>   "action": "opened",
>   "issue": {
>     "url": "http(s)://HOSTNAME/api/v3/repos/octocat/Hello-World/issues/1347",
>     "number": 1347,
>     ...
>   },
>   "repository" : {
>     "id": 1296269,
>     "full_name": "octocat/Hello-World",
>     "owner": {
>       "login": "octocat",
>       "id": 1,
>       ...
>     },
>     ...
>   },
>   "sender": {
>     "login": "octocat",
>     "id": 1,
>     ...
>   }
> }

branch_protection_configuration

This event occurs when there is a change to branch protection configurations for a repository. For more information, see "About protected branches." For information about using the APIs to manage branch protection rules, see "Branch protection rule" in the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

Availability for branch_protection_configuration

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for branch_protection_configuration

All branch protections were disabled for a repository.

Webhook request body parameters
action string Required

Value: disabled

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

branch_protection_rule

This event occurs when there is activity relating to branch protection rules. For more information, see "About protected branches." For information about the APIs to manage branch protection rules, see the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

Availability for branch_protection_rule

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for branch_protection_rule

A branch protection rule was created.

Webhook request body parameters
action string Required

Value: created

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

rule object Required

The branch protection rule. Includes a name and all the branch protection settings applied to branches that match the name. Binary settings are boolean. Multi-level configurations are one of off, non_admins, or everyone. Actor and build lists are arrays of strings.

sender object Required

A GitHub user.

cache_sync

This event occurs when a Git ref has been successfully synced to a cache replica. For more information, see "About repository caching."

Availability for cache_sync

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for cache_sync

Webhook request body parameters
after string Required
before string Required
cache_location string Required
enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

ref string Required
repository object

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object

A GitHub user.

check_run

This event occurs when there is activity relating to a check run. For information about check runs, see "Getting started with the Checks API." For information about the APIs to manage check runs, see the GraphQL API documentation or "Check Runs" in the REST API documentation.

For activity relating to check suites, use the check-suite event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" repository permission. To receive the rerequested and requested_action event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the created and completed event types in repositories.

Note

The API only looks for pushes in the repository where the check run was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

Availability for check_run

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for check_run

A check run was completed, and a conclusion is available.

Webhook request body parameters
action string

Value: completed

check_run object Required

A check performed on the code of a given code change

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

check_suite

This event occurs when there is activity relating to a check suite. For information about check suites, see "Getting started with the Checks API." For information about the APIs to manage check suites, see the GraphQL API documentation or "Check Suites" in the REST API documentation.

For activity relating to check runs, use the check_run event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" permission. To receive the requested and rerequested event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the completed event types in repositories.

Note

The API only looks for pushes in the repository where the check suite was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

Availability for check_suite

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for check_suite

All check runs in a check suite have completed, and a conclusion is available.

Webhook request body parameters
action string Required

Value: completed

check_suite object Required
enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

code_scanning_alert

This event occurs when there is activity relating to code scanning alerts in a repository. For more information, see "About code scanning" and "About code scanning alerts." For information about the API to manage code scanning, see "Code scanning" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Code scanning alerts" repository permission.

Availability for code_scanning_alert

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for code_scanning_alert

A previously created code scanning alert appeared in another branch. This can happen when a branch is merged into or created from a branch with a pre-existing code scanning alert.

Webhook request body parameters
action string Required

Value: appeared_in_branch

alert object Required

The code scanning alert involved in the event.

commit_oid string Required

The commit SHA of the code scanning alert. When the action is reopened_by_user or closed_by_user, the event was triggered by the sender and this value will be empty.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

ref string Required

The Git reference of the code scanning alert. When the action is reopened_by_user or closed_by_user, the event was triggered by the sender and this value will be empty.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

commit_comment

This event occurs when there is activity relating to commit comments. For more information about commit comments, see "Commenting on a pull request." For information about the APIs to manage commit comments, see the GraphQL API documentation or "Commit comments" in the REST API documentation.

For activity relating to comments on pull request reviews, use the pull_request_review_comment event. For activity relating to issue comments, use the issue_comment event. For activity relating to discussion comments, use the discussion_comment event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

Availability for commit_comment

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for commit_comment

Someone commented on a commit.

Webhook request body parameters
action string Required

The action performed. Can be created.

Value: created

comment object Required

The commit comment resource.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

create

This event occurs when a Git branch or tag is created.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

Notes:

  • This event will not occur when more than three tags are created at once.
  • Payloads are capped at 25 MB. If an event generates a larger payload, GitHub will not deliver a payload for that webhook event. This may happen, for example, if many branches or tags are pushed at once. We suggest monitoring your payload size to ensure delivery.

Availability for create

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for create

Webhook request body parameters
description string or null Required

The repository's current description.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

master_branch string Required

The name of the repository's default branch (usually main).

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

pusher_type string Required

The pusher type for the event. Can be either user or a deploy key.

ref string Required

The git ref resource.

ref_type string Required

The type of Git ref object created in the repository.

Can be one of: tag, branch

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

delete

This event occurs when a Git branch or tag is deleted. To subscribe to all pushes to a repository, including branch and tag deletions, use the push webhook event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

Note

This event will not occur when more than three tags are deleted at once.

Availability for delete

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for delete

Webhook request body parameters
enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

pusher_type string Required

The pusher type for the event. Can be either user or a deploy key.

ref string Required

The git ref resource.

ref_type string Required

The type of Git ref object deleted in the repository.

Can be one of: tag, branch

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

dependabot_alert

This event occurs when there is activity relating to Dependabot alerts.

For more information about Dependabot alerts, see "About Dependabot alerts." For information about the API to manage Dependabot alerts, see "Dependabot alerts" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Dependabot alerts" repository permission.

Note

Webhook events for Dependabot alerts are currently in public preview and subject to change.

Availability for dependabot_alert

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for dependabot_alert

A Dependabot alert was automatically closed by a Dependabot auto-triage rule.

Webhook request body parameters
action string Required

Value: auto_dismissed

alert object Required

A Dependabot alert.

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

deploy_key

This event occurs when there is activity relating to deploy keys. For more information, see "Managing deploy keys." For information about the APIs to manage deploy keys, see the GraphQL API documentation or "Deploy keys" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Deployments" repository permission.

Availability for deploy_key

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for deploy_key

A deploy key was created.

Webhook request body parameters
action string Required

Value: created

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

key object Required

The deploy key resource.

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

deployment

This event occurs when there is activity relating to deployments. For more information, see "About deployments." For information about the APIs to manage deployments, see the GraphQL API documentation or "Deployments" in the REST API documentation.

For activity relating to deployment status, use the deployment_status event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Deployments" repository permission.

Availability for deployment

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for deployment

A deployment was created.

Webhook request body parameters
action string Required

Value: created

deployment object Required
enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object Required

A GitHub user.

workflow object or null Required
workflow_run object or null Required

deployment_protection_rule

This event occurs when there is activity relating to deployment protection rules. For more information, see "Using environments for deployment." For information about the API to manage deployment protection rules, see the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Deployments" repository permission.

Availability for deployment_protection_rule

  • GitHub Apps

Webhook payload object for deployment_protection_rule

A deployment protection rule was requested for an environment.

Webhook request body parameters
action string

Value: requested

environment string

The name of the environment that has the deployment protection rule.

event string

The event that triggered the deployment protection rule.

deployment_callback_url string

The URL to review the deployment protection rule.

deployment object

A request for a specific ref(branch,sha,tag) to be deployed

pull_requests array of objects
repository object

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

sender object

A GitHub user.

deployment_review

This event occurs when there is activity relating to deployment reviews. For more information, see "About deployments." For information about the APIs to manage deployments, see the GraphQL API documentation or "Deployments" in the REST API documentation.

For activity relating to deployment creation or deployment status, use the deployment or deployment_status event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Deployments" repository permission.

Availability for deployment_review

  • GitHub Apps

Webhook payload object for deployment_review

A deployment review was approved.

Webhook request body parameters
action string Required

Value: approved

approver object
comment string
enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object Required

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object Required

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

reviewers array of objects
sender object Required

A GitHub user.

since string Required
workflow_job_run object
workflow_job_runs array of objects
workflow_run object or null Required

deployment_status

This event occurs when there is activity relating to deployment statuses. For more information, see "About deployments." For information about the APIs to manage deployments, see the GraphQL API documentation or "Deployments" in the REST API documentation.

For activity relating to deployment creation, use the deployment event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Deployments" repository permission.

Note

A webhook event is not fired for deployment statuses with an inactive state.

Availability for deployment_status

  • Repositories
  • Organizations
  • GitHub Apps

Webhook payload object for deployment_status

A new deployment status was created.

Webhook request body parameters