Webhook のイベントとペイロード

各 Webhook イベントが発生するタイミングと、そのペイロードに含まれる内容について説明します。

この記事で

Webhook イベントとペイロードについて

このページに表示されているイベントをサブスクライブする webhook を作成できます。サーバーへの HTTP 要求の数を制限するには、扱う予定の特定のイベントだけをサブスクライブする必要があります。詳しくは、「webhookの作成」をご覧ください。

このページの各 webhook イベントには、そのイベントの webhook プロパティの説明が含まれています。イベントに複数のアクションがある場合は、各アクションに対応するプロパティが含まれます。

各イベントは、特定の種類の Webhook でのみ使用できます。たとえば、組織の Webhook は team イベントにサブスクライブできますが、リポジトリの Webhook はサブスクライブできません。各 Webhook イベントの説明に、そのイベントの可用性を一覧で示します。詳しくは、「Webhook の種類」をご覧ください。

ほとんどの webhook ペイロードには、イベントをトリガーしたユーザーを識別する sender プロパティが含まれています。イベントがユーザーではなく内部プロセスから発生した場合や、トリガーアクションにユーザーが関連付けられていない場合など、特定のユーザーを解決できない GitHub があります。 check_runやcheck_suiteなどの一部のイベントには、Git プッシュや認証済み API アクターのないアクションが含まれます。

このような場合、sender には、ghost がであり、login が実在する現在のユーザーに関連付けられていないプレースホルダーアカウントである id が設定されます。 senderは常にイベントの原因となった人物を識別し、それに依存するセキュリティまたはビジネスロジックでghost ユーザーを考慮するとは限りません。

ペイロードの上限

ペイロードの上限は 25 MB です。イベントにより大きなペイロードが生成された場合、GitHub はその webhook イベントのペイロードを配信しません。これは、たとえば、多数のブランチまたはタグが一度にプッシュされた場合に、create イベントで発生する可能性があります。確実にデリバリが行われるよう、ペイロードサイズを監視することをお勧めします。

配信ヘッダー

webhook によって設定されている URL エンドポイントに配信される HTTP POST ペイロードには、いくつかの特別なヘッダが含まれています。

X-GitHub-Hook-ID: webhook の一意識別子。
X-GitHub-Event: 配信をトリガーしたイベントの名前。
X-GitHub-Delivery: イベントを識別するためのグローバルに一意な識別子 (GUID)。
X-Hub-Signature: このヘッダーは、Webhook が secret で構成されている場合に送信されます。これは要求本文の HMAC 16 進ダイジェストであり、SHA-1 ハッシュ関数と secret (HMAC key として) を使用して生成されます。 X-Hub-Signature は、既存の統合との互換性のために提供されています。代わりに、さらに安全な X-Hub-Signature-256 の使用をおすすめします。
X-Hub-Signature-256: このヘッダーは、Webhook が secret で構成されている場合に送信されます。これは要求本文の HMAC 16 進ダイジェストであり、SHA-256 ハッシュ関数と secret (HMAC key として) を使用して生成されます。詳しくは、「Webhook 配信を検証する」をご覧ください。
User-Agent: このヘッダーには常にプレフィックス GitHub-Hookshot/があります。
X-GitHub-Hook-Installation-Target-Type: Webhook が作成されたリソースの種類。
X-GitHub-Hook-Installation-Target-ID: Webhook が作成されたリソースである一意識別子。

Webhook ペイロード内の各ヘッダーの表示を確認するには、「Webhook 配信の例」を参照してください。

Webhook 配信の例

ペイロードは JSON 形式 (application/json) または URL エンコードしたデータ (x-www-form-urlencoded) として配信することができます。 JSON 形式を使用する webhook POST 要求の例を次に示します。

> POST /payload HTTP/1.1

> X-GitHub-Delivery: 72d3162e-cc78-11e3-81ab-4c9367dc0958
> X-Hub-Signature: sha1=7d38cdd689735b008b3c702edd92eea23791c5f6
> X-Hub-Signature-256: sha256=d57c68ca6f92289e6987922ff26938930f6e66a2d161ef06abdf1859230aa23c
> User-Agent: GitHub-Hookshot/044aadd
> Content-Type: application/json
> Content-Length: 6615
> X-GitHub-Event: issues
> X-GitHub-Hook-ID: 292430182
> X-GitHub-Hook-Installation-Target-ID: 79929171
> X-GitHub-Hook-Installation-Target-Type: repository

> {
>   "action": "opened",
>   "issue": {
>     "url": "https://api.github.com/repos/octocat/Hello-World/issues/1347",
>     "number": 1347,
>     ...
>   },
>   "repository" : {
>     "id": 1296269,
>     "full_name": "octocat/Hello-World",
>     "owner": {
>       "login": "octocat",
>       "id": 1,
>       ...
>     },
>     ...
>   },
>   "sender": {
>     "login": "octocat",
>     "id": 1,
>     ...
>   }
> }

branch_protection_configuration

This event occurs when there is a change to branch protection configurations for a repository. For more information, see "About protected branches." For information about using the APIs to manage branch protection rules, see "Branch protection rule" in the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

`branch_protection_configuration` の可用性

リポジトリ
組織
GitHub アプリ

`branch_protection_configuration` の Webhook ペイロードオブジェクト

All branch protections were disabled for a repository.

Webhook リクエスト本文のパラメーター
名前, タイプ, 説明
`action` string 必須価値: `disabled`
`enterprise` object An enterprise on GitHub. Webhook payloads contain the `enterprise` property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."
`installation` object The GitHub App installation. Webhook payloads contain the `installation` property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."
`organization` object A GitHub organization. Webhook payloads contain the `organization` property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.
`repository` object 必須 The repository on GitHub where the event occurred. Webhook payloads contain the `repository` property when the event occurs from activity in a repository.
`sender` object 必須 A GitHub user.

branch_protection_rule

This event occurs when there is activity relating to branch protection rules. For more information, see "About protected branches." For information about the APIs to manage branch protection rules, see the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

`branch_protection_rule` の可用性

リポジトリ
組織
GitHub アプリ

`branch_protection_rule` の Webhook ペイロードオブジェクト

A branch protection rule was created.

Webhook リクエスト本文のパラメーター
名前, タイプ, 説明
`action` string 必須価値: `created`
`enterprise` object An enterprise on GitHub. Webhook payloads contain the `enterprise` property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."
`installation` object The GitHub App installation. Webhook payloads contain the `installation` property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."
`organization` object A GitHub organization. Webhook payloads contain the `organization` property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.
`repository` object 必須 The repository on GitHub where the event occurred. Webhook payloads contain the `repository` property when the event occurs from activity in a repository.
`rule` object 必須 The branch protection rule. Includes a `name` and all the branch protection settings applied to branches that match the name. Binary settings are boolean. Multi-level configurations are one of `off`, `non_admins`, or `everyone`. Actor and build lists are arrays of strings.
Properties of `rule`
`sender` object 必須 A GitHub user.

check_run

This event occurs when there is activity relating to a check run. For information about check runs, see "Getting started with the Checks API." For information about the APIs to manage check runs, see the GraphQL API documentation or "Check Runs" in the REST API documentation.

For activity relating to check suites, use the check-suite event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" repository permission. To receive the rerequested and requested_action event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the created and completed event types in repositories.

The API only looks for pushes in the repository where the check run was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

`check_run` の可用性

リポジトリ
組織
GitHub アプリ

`check_run` の Webhook ペイロードオブジェクト

A check run was completed, and a conclusion is available.

Webhook リクエスト本文のパラメーター
名前, タイプ, 説明
`action` string 価値: `completed`
`check_run` object 必須 A check performed on the code of a given code change
Properties of `check_run`
`installation` object The GitHub App installation. Webhook payloads contain the `installation` property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."
`enterprise` object An enterprise on GitHub. Webhook payloads contain the `enterprise` property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."
`organization` object A GitHub organization. Webhook payloads contain the `organization` property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.
`repository` object 必須 The repository on GitHub where the event occurred. Webhook payloads contain the `repository` property when the event occurs from activity in a repository.
`sender` object 必須 A GitHub user.

check_suite

This event occurs when there is activity relating to a check suite. For information about check suites, see "Getting started with the Checks API." For information about the APIs to manage check suites, see the GraphQL API documentation or "Check Suites" in the REST API documentation.

For activity relating to check runs, use the check_run event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" permission. To receive the requested and rerequested event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the completed event types in repositories.

The API only looks for pushes in the repository where the check suite was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

`check_suite` の可用性

リポジトリ
組織
GitHub アプリ

`check_suite` の Webhook ペイロードオブジェクト

All check runs in a check suite have completed, and a conclusion is available.

Webhook リクエスト本文のパラメーター
名前, タイプ, 説明
`action` string 必須価値: `completed`
`check_suite` object 必須 The check_suite.
Properties of `check_suite`
`enterprise` object An enterprise on GitHub. Webhook payloads contain the `enterprise` property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."
`installation` object The GitHub App installation. Webhook payloads contain the `installation` property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."
`organization` object A GitHub organization. Webhook payloads contain the `organization` property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.
`repository` object 必須 The repository on GitHub where the event occurred. Webhook payloads contain the `repository` property when the event occurs from activity in a repository.
`sender` object 必須 A GitHub user.

code_scanning_alert

This event occurs when there is activity relating to code scanning alerts in a repository. For more information, see "About code scanning" and "About code scanning alerts." For information about the API to manage code scanning, see "Code scanning" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Code scanning alerts" repository permission.

`code_scanning_alert` の可用性

リポジトリ
組織
GitHub アプリ

`code_scanning_alert` の Webhook ペイロードオブジェクト

A previously created code scanning alert appeared in another branch. This can happen when a branch is merged into or created from a branch with a pre-existing code scanning alert.

Webhook リクエスト本文のパラメーター
名前, タイプ, 説明
`action` string 必須価値: `appeared_in_branch`
`alert` object 必須 The code scanning alert involved in the event.
Properties of `alert`
`commit_oid` string 必須 The commit SHA of the code scanning alert. When the action is `reopened_by_user` or `closed_by_user`, the event was triggered by the `sender` and this value will be empty.
`enterprise` object An enterprise on GitHub. Webhook payloads contain the `enterprise` property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."
`installation` object The GitHub App installation. Webhook payloads contain the `installation` property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."
`organization` object A GitHub organization. Webhook payloads contain the `organization` property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.
`ref` string 必須 The Git reference of the code scanning alert. When the action is `reopened_by_user` or `closed_by_user`, the event was triggered by the `sender` and this value will be empty.
`repository` object 必須 The repository on GitHub where the event occurred. Webhook payloads contain the `repository` property when the event occurs from activity in a repository.
`sender` object 必須 A GitHub user.

commit_comment

This event occurs when there is activity relating to commit comments. For more information about commit comments, see "Commenting on a pull request." For information about the APIs to manage commit comments, see the GraphQL API documentation or "Commit comments" in the REST API documentation.

For activity relating to comments on pull request reviews, use the pull_request_review_comment event. For activity relating to issue comments, use the issue_comment event. For activity relating to discussion comments, use the discussion_comment event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

`commit_comment` の可用性

リポジトリ
組織
GitHub アプリ

`commit_comment` の Webhook ペイロードオブジェクト

Someone commented on a commit.

Webhook リクエスト本文のパラメーター
名前, タイプ, 説明
`action` string 必須 The action performed. Can be `created`. 価値: `created`
`comment` object 必須 The commit comment resource.
Properties of `comment`
`enterprise` object An enterprise on GitHub. Webhook payloads contain the `enterprise` property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."
`installation` object The GitHub App installation. Webhook payloads contain the `installation` property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."
`organization` object A GitHub organization. Webhook payloads contain the `organization` property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.
`repository` object 必須 The repository on GitHub where the event occurred. Webhook payloads contain the `repository` property when the event occurs from activity in a repository.
`sender` object 必須 A GitHub user.

create

This event occurs when a Git branch or tag is created.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

Notes:

This event will not occur when more than three tags are created at once.
Payloads are capped at 25 MB. If an event generates a larger payload, GitHub will not deliver a payload for that webhook event. This may happen, for example, if many branches or tags are pushed at once. We suggest monitoring your payload size to ensure delivery.

`create` の可用性

リポジトリ
組織
GitHub アプリ

`create` の Webhook ペイロードオブジェクト

Webhook リクエスト本文のパラメーター
名前, タイプ, 説明
`description` string or null 必須 The repository's current description.
`enterprise` object An enterprise on GitHub. Webhook payloads contain the `enterprise` property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

Webhook のイベントとペイロード

この記事で

branch_protection_configuration の可用性

branch_protection_configuration の Webhook ペイロードオブジェクト

branch_protection_rule の可用性

branch_protection_rule の Webhook ペイロードオブジェクト

check_run の可用性

check_run の Webhook ペイロードオブジェクト

check_suite の可用性

check_suite の Webhook ペイロードオブジェクト

code_scanning_alert の可用性

code_scanning_alert の Webhook ペイロードオブジェクト

commit_comment の可用性

commit_comment の Webhook ペイロードオブジェクト

create の可用性

create の Webhook ペイロードオブジェクト