Webhook のイベントとペイロード

各 Webhook イベントが発生するタイミングと、そのペイロードに含まれる内容について説明します。

この記事で

Webhook イベントとペイロードについて

このページに表示されているイベントをサブスクライブする webhook を作成できます。 サーバーへの HTTP 要求の数を制限するには、扱う予定の特定のイベントだけをサブスクライブする必要があります。 詳しくは、「webhookの作成」をご覧ください。

このページの各 webhook イベントには、そのイベントの webhook プロパティの説明が含まれています。 イベントに複数のアクションがある場合は、各アクションに対応するプロパティが含まれます。

各イベントは、特定の種類の Webhook でのみ使用できます。 たとえば、組織の Webhook は team イベントにサブスクライブできますが、リポジトリの Webhook はサブスクライブできません。 各 Webhook イベントの説明に、そのイベントの可用性を一覧で示します。 詳しくは、「Webhook の種類」をご覧ください。

sender プロパティ

ほとんどの webhook ペイロードには、イベントをトリガーしたユーザーを識別する sender プロパティが含まれています。 イベントがユーザーではなく内部プロセスから発生した場合や、トリガー アクションにユーザーが関連付けられていない場合など、特定のユーザーを解決できない GitHub があります。 check_runやcheck_suiteなどの一部のイベントには、Git プッシュや認証済み API アクターのないアクションが含まれます。

このような場合、sender には、ghost が であり、login が実在する現在のユーザーに関連付けられていないプレースホルダー アカウントである id が設定されます。 senderは常にイベントの原因となった人物を識別し、それに依存するセキュリティまたはビジネス ロジックでghost ユーザーを考慮するとは限りません。

ペイロードの上限

ペイロードの上限は 25 MB です。 イベントにより大きなペイロードが生成された場合、GitHub はその webhook イベントのペイロードを配信しません。 これは、たとえば、多数のブランチまたはタグが一度にプッシュされた場合に、create イベントで発生する可能性があります。 確実にデリバリが行われるよう、ペイロードサイズを監視することをお勧めします。

配信ヘッダー

webhook によって設定されている URL エンドポイントに配信される HTTP POST ペイロードには、いくつかの特別なヘッダが含まれています。

  • X-GitHub-Hook-ID: webhook の一意識別子。
  • X-GitHub-Event: 配信をトリガーしたイベントの名前。
  • X-GitHub-Delivery: イベントを識別するためのグローバルに一意な識別子 (GUID)。
  • X-Hub-Signature: このヘッダーは、Webhook が secret で構成されている場合に送信されます。 これは要求本文の HMAC 16 進ダイジェストであり、SHA-1 ハッシュ関数と secret (HMAC key として) を使用して生成されます。 X-Hub-Signature は、既存の統合との互換性のために提供されています。 代わりに、さらに安全な X-Hub-Signature-256 の使用をおすすめします。
  • X-Hub-Signature-256: このヘッダーは、Webhook が secret で構成されている場合に送信されます。 これは要求本文の HMAC 16 進ダイジェストであり、SHA-256 ハッシュ関数と secret (HMAC key として) を使用して生成されます。 詳しくは、「Webhook 配信を検証する」をご覧ください。
  • User-Agent: このヘッダーには常にプレフィックス GitHub-Hookshot/があります。
  • X-GitHub-Hook-Installation-Target-Type: Webhook が作成されたリソースの種類。
  • X-GitHub-Hook-Installation-Target-ID: Webhook が作成されたリソースである一意 識別子。

Webhook ペイロード内の各ヘッダーの表示を確認するには、「Webhook 配信の例」を参照してください。

Webhook 配信の例

ペイロードは JSON 形式 (application/json) または URL エンコードしたデータ (x-www-form-urlencoded) として配信することができます。 JSON 形式を使用する webhook POST 要求の例を次に示します。

> POST /payload HTTP/1.1

> X-GitHub-Delivery: 72d3162e-cc78-11e3-81ab-4c9367dc0958
> X-Hub-Signature: sha1=7d38cdd689735b008b3c702edd92eea23791c5f6
> X-Hub-Signature-256: sha256=d57c68ca6f92289e6987922ff26938930f6e66a2d161ef06abdf1859230aa23c
> User-Agent: GitHub-Hookshot/044aadd
> Content-Type: application/json
> Content-Length: 6615
> X-GitHub-Event: issues
> X-GitHub-Hook-ID: 292430182
> X-GitHub-Hook-Installation-Target-ID: 79929171
> X-GitHub-Hook-Installation-Target-Type: repository

> {
>   "action": "opened",
>   "issue": {
>     "url": "https://api.github.com/repos/octocat/Hello-World/issues/1347",
>     "number": 1347,
>     ...
>   },
>   "repository" : {
>     "id": 1296269,
>     "full_name": "octocat/Hello-World",
>     "owner": {
>       "login": "octocat",
>       "id": 1,
>       ...
>     },
>     ...
>   },
>   "sender": {
>     "login": "octocat",
>     "id": 1,
>     ...
>   }
> }

branch_protection_configuration

This event occurs when there is a change to branch protection configurations for a repository. For more information, see "About protected branches." For information about using the APIs to manage branch protection rules, see "Branch protection rule" in the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

branch_protection_configuration の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

branch_protection_configuration の Webhook ペイロードオブジェクト

All branch protections were disabled for a repository.

Webhook リクエスト本文のパラメーター
action string 必須

価値: disabled

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object 必須

A GitHub user.

branch_protection_rule

This event occurs when there is activity relating to branch protection rules. For more information, see "About protected branches." For information about the APIs to manage branch protection rules, see the GraphQL documentation or "Branch protection" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.

branch_protection_rule の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

branch_protection_rule の Webhook ペイロードオブジェクト

A branch protection rule was created.

Webhook リクエスト本文のパラメーター
action string 必須

価値: created

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

rule object 必須

The branch protection rule. Includes a name and all the branch protection settings applied to branches that match the name. Binary settings are boolean. Multi-level configurations are one of off, non_admins, or everyone. Actor and build lists are arrays of strings.

sender object 必須

A GitHub user.

bypass_request_secret_scanning

This event occurs when there is activity related to a user's request to bypass secret scanning push protection.

For more information, see "Enabling delegated bypass for push protection."

To subscribe to this event, a GitHub App must have at least read-level access for the "Secret scanning alerts" repository permission.

Note: Delegated bypass for push protection is currently in public preview and subject to change.

bypass_request_secret_scanning の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

bypass_request_secret_scanning の Webhook ペイロードオブジェクト

A secret scanning push protection bypass request was cancelled.

Webhook リクエスト本文のパラメーター
action string 必須

価値: cancelled

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

exemption_request object 必須

A request from a user to be exempted from a set of rules.

sender object 必須

A GitHub user.

check_run

This event occurs when there is activity relating to a check run. For information about check runs, see "Getting started with the Checks API." For information about the APIs to manage check runs, see the GraphQL API documentation or "Check Runs" in the REST API documentation.

For activity relating to check suites, use the check-suite event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" repository permission. To receive the rerequested and requested_action event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the created and completed event types in repositories.

The API only looks for pushes in the repository where the check run was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

check_run の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

check_run の Webhook ペイロードオブジェクト

A check run was completed, and a conclusion is available.

Webhook リクエスト本文のパラメーター
action string

価値: completed

check_run object 必須

A check performed on the code of a given code change

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object 必須

A GitHub user.

check_suite

This event occurs when there is activity relating to a check suite. For information about check suites, see "Getting started with the Checks API." For information about the APIs to manage check suites, see the GraphQL API documentation or "Check Suites" in the REST API documentation.

For activity relating to check runs, use the check_run event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Checks" permission. To receive the requested and rerequested event types, the app must have at least write-level access for the "Checks" permission. GitHub Apps with write-level access for the "Checks" permission are automatically subscribed to this webhook event.

Repository and organization webhooks only receive payloads for the completed event types in repositories.

The API only looks for pushes in the repository where the check suite was created. Pushes to a branch in a forked repository are not detected and return an empty pull_requests array and a null value for head_branch.

check_suite の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

check_suite の Webhook ペイロードオブジェクト

All check runs in a check suite have completed, and a conclusion is available.

Webhook リクエスト本文のパラメーター
action string 必須

価値: completed

check_suite object 必須
enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object 必須

A GitHub user.

code_scanning_alert

This event occurs when there is activity relating to code scanning alerts in a repository. For more information, see "About code scanning" and "About code scanning alerts." For information about the API to manage code scanning, see "Code scanning" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Code scanning alerts" repository permission.

code_scanning_alert の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

code_scanning_alert の Webhook ペイロードオブジェクト

A previously created code scanning alert appeared in another branch. This can happen when a branch is merged into or created from a branch with a pre-existing code scanning alert.

Webhook リクエスト本文のパラメーター
action string 必須

価値: appeared_in_branch

alert object 必須

The code scanning alert involved in the event.

commit_oid string 必須

The commit SHA of the code scanning alert. When the action is reopened_by_user or closed_by_user, the event was triggered by the sender and this value will be empty.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

ref string 必須

The Git reference of the code scanning alert. When the action is reopened_by_user or closed_by_user, the event was triggered by the sender and this value will be empty.

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object 必須

A GitHub user.

commit_comment

This event occurs when there is activity relating to commit comments. For more information about commit comments, see "Commenting on a pull request." For information about the APIs to manage commit comments, see the GraphQL API documentation or "Commit comments" in the REST API documentation.

For activity relating to comments on pull request reviews, use the pull_request_review_comment event. For activity relating to issue comments, use the issue_comment event. For activity relating to discussion comments, use the discussion_comment event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

commit_comment の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

commit_comment の Webhook ペイロードオブジェクト

Someone commented on a commit.

Webhook リクエスト本文のパラメーター
action string 必須

The action performed. Can be created.

価値: created

comment object 必須

The commit comment resource.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object 必須

A GitHub user.

create

This event occurs when a Git branch or tag is created.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

Notes:

  • This event will not occur when more than three tags are created at once.
  • Payloads are capped at 25 MB. If an event generates a larger payload, GitHub will not deliver a payload for that webhook event. This may happen, for example, if many branches or tags are pushed at once. We suggest monitoring your payload size to ensure delivery.

create の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

create の Webhook ペイロードオブジェクト

Webhook リクエスト本文のパラメーター
description string or null 必須

The repository's current description.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

master_branch string 必須

The name of the repository's default branch (usually main).

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

pusher_type string 必須

The pusher type for the event. Can be either user or a deploy key.

ref string 必須

The git ref resource.

ref_type string 必須

The type of Git ref object created in the repository.

次のいずれかにできます: tag, branch

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object 必須

A GitHub user.

custom_property

This event occurs when there is activity relating to a custom property.

For more information, see "Managing custom properties for repositories in your organization". For information about the APIs to manage custom properties, see "Custom properties" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Custom properties" organization permission.

custom_property の可用性

  • 企業
  • 組織
  • GitHub アプリ

custom_property の Webhook ペイロードオブジェクト

A new custom property was created.

Webhook リクエスト本文のパラメーター
action string 必須

価値: created

definition object 必須

Custom property defined on an organization

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

sender object

A GitHub user.

custom_property_values

This event occurs when there is activity relating to custom property values for a repository.

For more information, see "Managing custom properties for repositories in your organization". For information about the APIs to manage custom properties for a repository, see "Custom properties" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Custom properties" organization permission.

custom_property_values の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

custom_property_values の Webhook ペイロードオブジェクト

The custom property values of a repository were updated.

Webhook リクエスト本文のパラメーター
action string 必須

価値: updated

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

organization object 必須

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

sender object

A GitHub user.

new_property_values array of objects 必須

The new custom property values for the repository.

old_property_values array of objects 必須

The old custom property values for the repository.

delete

This event occurs when a Git branch or tag is deleted. To subscribe to all pushes to a repository, including branch and tag deletions, use the push webhook event.

To subscribe to this event, a GitHub App must have at least read-level access for the "Contents" repository permission.

This event will not occur when more than three tags are deleted at once.

delete の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

delete の Webhook ペイロードオブジェクト

Webhook リクエスト本文のパラメーター
enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

pusher_type string 必須

The pusher type for the event. Can be either user or a deploy key.

ref string 必須

The git ref resource.

ref_type string 必須

The type of Git ref object deleted in the repository.

次のいずれかにできます: tag, branch

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object 必須

A GitHub user.

dependabot_alert

This event occurs when there is activity relating to Dependabot alerts.

For more information about Dependabot alerts, see "About Dependabot alerts." For information about the API to manage Dependabot alerts, see "Dependabot alerts" in the REST API documentation.

To subscribe to this event, a GitHub App must have at least read-level access for the "Dependabot alerts" repository permission.

dependabot_alert の可用性

  • リポジトリ
  • 組織
  • GitHub アプリ

dependabot_alert の Webhook ペイロードオブジェクト

The assignees for a Dependabot alert were updated.

Webhook リクエスト本文のパラメーター
action string 必須

価値: assignees_changed

alert object 必須

A Dependabot alert.

installation object

The GitHub App installation. Webhook payloads contain the installation property when the event is configured for and sent to a GitHub App. For more information, see "Using webhooks with GitHub Apps."

organization object

A GitHub organization. Webhook payloads contain the organization property when the webhook is configured for an organization, or when the event occurs from activity in a repository owned by an organization.

enterprise object

An enterprise on GitHub. Webhook payloads contain the enterprise property when the webhook is configured on an enterprise account or an organization that's part of an enterprise account. For more information, see "About enterprise accounts."

repository object 必須

The repository on GitHub where the event occurred. Webhook payloads contain the repository property when the event occurs from activity in a repository.

sender object 必須

A GitHub user.

deploy_key

This event occurs when there is activity relating to deploy keys. For more information, see "Managing deploy keys." For information about the APIs to manage deploy keys, see the GraphQL API documentation or "Deploy keys" in the REST API documentation.