#Webhooks

---

#POST /{o}/{p}/webhooks/github

Receive a GitHub pull_request webhook

HMAC-authenticated (X-Hub-Signature-256) against the webhook secrets configured on the actions of the project named in the path. Transitions that project's matching pull-request ActionRun on PR close (merged → succeeded, closed → failed). Events the route does not act on are acknowledged with 200 once the signature verifies; everything unverified is a 401. No Bearer token.

Auth: HMAC-SHA256 signature (X-Hub-Signature-256 header) · Webhook self-auth — no Bearer token.

Path parameters

Name	Type	Description
o	string
p	string

Responses

Status	Description	Schema
200	OK	WebhookAck
400	Bad Request	Error
401	Unauthorized	Error
403	Forbidden	Error

---

#POST /webhooks/github

Receive GitHub App webhook events

HMAC-authenticated (X-Hub-Signature-256, keyed on the GitHub App webhook secret, checked by the contract's HMAC guard against the key the route declares). Dispatches installation/repo lifecycle events. No Bearer token. 503 when the GitHub App is not configured on this deployment.

Auth: HMAC-SHA256 signature (X-Hub-Signature-256 header) · Webhook self-auth — no Bearer token.

Responses

Status	Description	Schema
200	OK	GitHubWebhookOutcome
400	Bad Request	Error
401	Unauthorized	Error
403	Forbidden	Error
404	Not Found	Error
503	Service Unavailable	Error

#Schemas

#Error

Field	Type	Description
error	string	(required)
code	string

#GitHubWebhookOutcome

Field	Type	Description
ok	true	(required)
outcome	object

#WebhookAck

Field	Type	Description
ok	true	(required)