Organisations

Receive a GitHub App event. Called by GitHub, not by clients

Called by GitHub.

POST/github/webhook

TL;DR

Question	Answer
What does it do?	Receive a GitHub App event. Called by GitHub, not by clients.
What does it take?	A JSON body of type `object`.
What does it return?	Status 200 with a body of type `GithubWebhookAck`.
What can go wrong?	`400` a header is missing; `401` the signature does not match (github.signature_invalid); `413` the body is larger than 1 MiB; `429` too many requests; `500` the delivery could not be applied; GitHub may send it again; `503` the GitHub App is not set up on this server (github.not_configured). Every failure uses the one error envelope.

What it does

Called by GitHub. Checks X-Hub-Signature-256 over the exact bytes first, refuses a delivery seen before, and makes a few row changes for installation, installation_repositories, push and pull_request events. Anything else is acknowledged and ignored.

Header parameters

Field	Type	Required	Description
`x-hub-signature-256`	`string`	no	sha256= and the HMAC SHA-256 of the exact body under the webhook secret.
`x-github-event`	`string`	yes	The event, such as installation or pull_request.
`x-github-delivery`	`string`	yes	The delivery's id, the same when GitHub sends it again.

Request body

The body has the type object.

Field	Type	Required	Description

Responses

Status	Meaning	Body
200	Applied, or a duplicate.	`GithubWebhookAck`
202	Ignored: nothing this App acts on.	`GithubWebhookAck`
400	A header is missing.	`ErrorResponse`
401	The signature does not match (github.signature_invalid).	`ErrorResponse`
413	The body is larger than 1 MiB.	`ErrorResponse`
429	Too many requests.	`ErrorResponse`
500	The delivery could not be applied; GitHub may send it again.	`ErrorResponse`
503	The GitHub App is not set up on this server (github.not_configured).	`ErrorResponse`

Response body

A 200 answer has the type GithubWebhookAck.

Field	Type	Required	Description
`outcome`	`"applied" \| "duplicate" \| "ignored"`	yes	`applied`: rows changed. `duplicate`: this delivery was applied before. `ignored`: nothing this App acts on.

Doc	Why
API reference	Every endpoint, and the error envelope
Schemas	Every request and response type
Tool reference	The operations as callable tools