Webhook events and payloads

When configuring a webhook, you can choose which events will send you payloads. To limit the number of HTTP requests to your server, you should only subscribe to the specific events that you plan on handling. By default, webhooks installed on GitHub Enterprise, an [organization][org-hooks], or a [repository][repo-hooks] are only subscribed to the push event. By default, webhooks on GitHub Apps are not subscribed to any events. You can change events that a webhook is subscribed to at any time.

You can create webhooks that subscribe to the events listed on this page. Each webhook event includes a description of the webhook properties and an example payload. For more information, see "Creating webhooks."

Webhook payload object common properties

Each webhook event payload also contains properties unique to the event. You can find the unique properties in the individual event type sections.

The unique properties for a webhook event are the same properties you'll find in the payload property when using the Events API. One exception is the push event. The unique properties of the push event webhook payload and the payload property in the Events API differ. The webhook payload contains more detailed information.

Delivery headers

HTTP POST payloads that are delivered to your webhook's configured URL endpoint will contain several special headers.

• X-GitHub-Event: Name of the event that triggered the delivery.
• X-GitHub-Delivery: A GUID to identify the delivery.
• X-GitHub-Enterprise-Version: The version of the GitHub Enterprise Server instance that sent the HTTP POST payload.
• X-GitHub-Enterprise-Host: The hostname of the GitHub Enterprise Server instance that sent the HTTP POST payload.
• X-Hub-Signature: This header is sent if the webhook is configured with a secret. This is the HMAC hex digest of the request body, and is generated using the SHA-1 hash function and the secret as the HMAC key. X-Hub-Signature is provided for compatibility with existing integrations, and we recommend that you use the more secure X-Hub-Signature-256 instead.
• X-Hub-Signature-256: This header is sent if the webhook is configured with a secret. This is the HMAC hex digest of the request body, and is generated using the SHA-256 hash function and the secret as the HMAC key.

Also, the User-Agent for the requests will have the prefix GitHub-Hookshot/.

Example delivery

> POST /payload HTTP/2

> Host: localhost:4567
> X-GitHub-Delivery: 72d3162e-cc78-11e3-81ab-4c9367dc0958
> X-GitHub-Enterprise-Version: 2.15.0
> X-GitHub-Enterprise-Host: example.com
> X-Hub-Signature: sha1=7d38cdd689735b008b3c702edd92eea23791c5f6
> X-Hub-Signature-256: sha256=d57c68ca6f92289e6987922ff26938930f6e66a2d161ef06abdf1859230aa23c
> User-Agent: GitHub-Hookshot/044aadd
> Content-Type: application/json
> Content-Length: 6615
> X-GitHub-Event: issues

> {
>   "action": "opened",
>   "issue": {
>     "url": "http(s)://HOSTNAME/api/v3/repos/octocat/Hello-World/issues/1347",
>     "number": 1347,
>     ...
>   },
>   "repository" : {
>     "id": 1296269,
>     "full_name": "octocat/Hello-World",
>     "owner": {
>       "login": "octocat",
>       "id": 1,
>       ...
>     },
>     ...
>   },
>   "sender": {
>     "login": "octocat",
>     "id": 1,
>     ...
>   }
> }