Webhook payloads

HMAC is over the raw JSON bytes. Field names below are stable enough to write a receiver against. Signature details: Webhooks.

Shared repository object

{
  "id": "uuid",
  "name": "my-repo",
  "full_name": "demo/my-repo",
  "default_branch": "main",
  "html_url": "https://amendable.io/r/demo/my-repo",
  "clone_url": "https://amendable.io/r/demo/my-repo.git",
  "owner": { "id": "user-uuid", "username": "demo" }
}

Git events (push, create, delete)

Field	Meaning
id	Event UUID
type	push, create, or delete
ref	refs/heads/main or refs/tags/v1.0.0
ref_name	main / v1.0.0
ref_type	branch, tag, or other
before / after	40-char hex. Null SHA is 40 zeros
created / deleted	booleans
commits	Commits introduced by the push (authors, message, parents, timestamp)
head_commit	Tip commit object, or { "id": "<after>" } if needed
tag	Tag object on tag refs that are not deletes, else null
repository	Object above

create is emitted with before all zeros. delete has after all zeros and no useful head_commit.

ping

{
  "id": "event-uuid",
  "type": "ping",
  "zen": "Clone the tip, run your pipeline, report your own status.",
  "hook_id": "webhook-uuid",
  "repository": null
}

repository is null when the ping is not tied to a specific repo.

Headers

See Webhooks. Signature header is hex HMAC-SHA256, not GitHub’s sha256= prefix.