# Receive a GitHub App event. Called by GitHub, not by clients

> Page: https://docs.plotwork.dev/api/post-github-webhook. Index of every page: https://docs.plotwork.dev/llms.txt

Called by GitHub.

`POST /github/webhook`

## TL;DR

| Question | Answer |
|---|---|
| What does it do? | Receive a GitHub App event. Called by GitHub, not by clients. |
| What does it take? | A JSON body of type `object`. |
| What does it return? | Status 200 with a body of type [`GithubWebhookAck`](https://docs.plotwork.dev/api/schemas.md#githubwebhookack). |
| What can go wrong? | `400` a header is missing; `401` the signature does not match (github.signature_invalid); `413` the body is larger than 1 MiB; `429` too many requests; `500` the delivery could not be applied; GitHub may send it again; `503` the GitHub App is not set up on this server (github.not_configured). Every failure uses the one error envelope. |

## What it does

Called by GitHub. Checks X-Hub-Signature-256 over the exact bytes first, refuses a delivery seen before, and makes a few row changes for installation, installation_repositories, push and pull_request events. Anything else is acknowledged and ignored.

## Header parameters

| Field | Type | Required | Description |
|---|---|---|---|
| `x-hub-signature-256` | `string` | no | sha256= and the HMAC SHA-256 of the exact body under the webhook secret. |
| `x-github-event` | `string` | yes | The event, such as installation or pull_request. |
| `x-github-delivery` | `string` | yes | The delivery's id, the same when GitHub sends it again. |

## Request body

The body has the type `object`.

| Field | Type | Required | Description |
|---|---|---|---|

## Responses

| Status | Meaning | Body |
|---|---|---|
| 200 | Applied, or a duplicate. | [`GithubWebhookAck`](https://docs.plotwork.dev/api/schemas.md#githubwebhookack) |
| 202 | Ignored: nothing this App acts on. | [`GithubWebhookAck`](https://docs.plotwork.dev/api/schemas.md#githubwebhookack) |
| 400 | A header is missing. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 401 | The signature does not match (github.signature_invalid). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 413 | The body is larger than 1 MiB. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 429 | Too many requests. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 500 | The delivery could not be applied; GitHub may send it again. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 503 | The GitHub App is not set up on this server (github.not_configured). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |

## Response body

A 200 answer has the type [`GithubWebhookAck`](https://docs.plotwork.dev/api/schemas.md#githubwebhookack).

| Field | Type | Required | Description |
|---|---|---|---|
| `outcome` | `"applied" \| "duplicate" \| "ignored"` | yes | `applied`: rows changed. `duplicate`: this delivery was applied before. `ignored`: nothing this App acts on. |

## See also

| Doc | Why |
|---|---|
| [API reference](https://docs.plotwork.dev/api/reference.md) | Every endpoint, and the error envelope |
| [Schemas](https://docs.plotwork.dev/api/schemas.md) | Every request and response type |
| [Tool reference](https://docs.plotwork.dev/mcp/tools.md) | The operations as callable tools |