Webhooks

GitHub deliveries for the site and API repositories. A delivery is kept only when its signature matches; anything unsigned is refused and only counted.

Secret—set on both sides
Verified—last 30 days
Refused—since the API restarted

Deliveries

    As GitHub sent it

    
      
    
      
    
        
    Verification
    
        
    
      
    
      
    
        
    Mapped record
    
        
    
      
    
    
    
  
    

  
    
    How a delivery is checked
    
    
      GitHub signs the exact bytes of each body with HMAC-SHA256 and a secret both sides hold. The
      API reads the body raw, computes the same signature and compares the two in constant time
      before it parses anything. A delivery that does not match gets a 401 and is never written
      down. A redelivery of one already kept is recognised by its delivery id and ignored.