GitHub push Webhook Payload Example

This branch-creation push uses refs/heads/main, an all-zero before SHA, and a synthetic after SHA. created is true; deleted and forced are false. commits contains the new commit and head_commit describes the tip. Route by the event header, not a guessed event type in the JSON.

Updated 2026-09-29 · Reduced synthetic fixture, not a complete provider schema.

Synthetic data only. All identities, IDs, commits and signature values are invented. No customer payloads or signing secrets are included. This tests request inspection, not provider delivery or signature verification. Never send production credentials or personal data here.

JSON payload

Download JSON

{
  "ref": "refs/heads/main",
  "before": "0000000000000000000000000000000000000000",
  "after": "1111111111111111111111111111111111111111",
  "created": true,
  "deleted": false,
  "forced": false,
  "base_ref": null,
  "compare": "https://example.com/synthetic/demo/compare/main",
  "repository": {
    "id": 1001,
    "name": "synthetic-demo",
    "full_name": "synthetic-org/synthetic-demo",
    "private": false,
    "html_url": "https://example.com/synthetic/demo"
  },
  "pusher": {
    "name": "synthetic-developer",
    "email": "[email protected]"
  },
  "sender": {
    "login": "synthetic-developer",
    "id": 1002,
    "type": "User"
  },
  "commits": [
    {
      "id": "1111111111111111111111111111111111111111",
      "message": "Synthetic fixture: add webhook handler",
      "timestamp": "2026-09-29T00:00:00Z",
      "url": "https://example.com/synthetic/demo/commit/example",
      "author": {
        "name": "Synthetic Developer",
        "email": "[email protected]"
      },
      "committer": {
        "name": "Synthetic Developer",
        "email": "[email protected]"
      },
      "added": [
        "webhook.js"
      ],
      "removed": [],
      "modified": []
    }
  ],
  "head_commit": {
    "id": "1111111111111111111111111111111111111111",
    "message": "Synthetic fixture: add webhook handler",
    "timestamp": "2026-09-29T00:00:00Z",
    "url": "https://example.com/synthetic/demo/commit/example",
    "author": {
      "name": "Synthetic Developer",
      "email": "[email protected]"
    },
    "committer": {
      "name": "Synthetic Developer",
      "email": "[email protected]"
    },
    "added": [
      "webhook.js"
    ],
    "removed": [],
    "modified": []
  }
}

Provider headers

Representative application headers for a JSON delivery. X-GitHub-Event selects the event contract; X-GitHub-Delivery identifies the delivery. X-Hub-Signature-256 is sent when a webhook secret is configured. Its value here is deliberately invalid. Transport headers and other GitHub headers are omitted.

Content-Type: application/json
X-GitHub-Event: push
X-GitHub-Delivery: 00000000-0000-4000-8000-000000000001
X-Hub-Signature-256: sha256=SYNTHETIC_NOT_A_VALID_SIGNATURE

Inspect this request

Create a temporary endpoint, send this exact synthetic JSON, and open the dashboard to inspect or delete it. No provider account is contacted. The default endpoint acknowledges the request; it does not validate the signature.

For Bash or a POSIX shell. Replace YOUR_BUCKET_ID before running; placeholder signatures will not pass a real receiver’s verification.

curl --request POST '/webhook/YOUR_BUCKET_ID' \
  --header 'Content-Type: application/json' \
  --header 'X-GitHub-Event: push' \
  --header 'X-GitHub-Delivery: 00000000-0000-4000-8000-000000000001' \
  --header 'X-Hub-Signature-256: sha256=SYNTHETIC_NOT_A_VALID_SIGNATURE' \
  --data-binary '{
  "ref": "refs/heads/main",
  "before": "0000000000000000000000000000000000000000",
  "after": "1111111111111111111111111111111111111111",
  "created": true,
  "deleted": false,
  "forced": false,
  "base_ref": null,
  "compare": "https://example.com/synthetic/demo/compare/main",
  "repository": {
    "id": 1001,
    "name": "synthetic-demo",
    "full_name": "synthetic-org/synthetic-demo",
    "private": false,
    "html_url": "https://example.com/synthetic/demo"
  },
  "pusher": {
    "name": "synthetic-developer",
    "email": "[email protected]"
  },
  "sender": {
    "login": "synthetic-developer",
    "id": 1002,
    "type": "User"
  },
  "commits": [
    {
      "id": "1111111111111111111111111111111111111111",
      "message": "Synthetic fixture: add webhook handler",
      "timestamp": "2026-09-29T00:00:00Z",
      "url": "https://example.com/synthetic/demo/commit/example",
      "author": {
        "name": "Synthetic Developer",
        "email": "[email protected]"
      },
      "committer": {
        "name": "Synthetic Developer",
        "email": "[email protected]"
      },
      "added": [
        "webhook.js"
      ],
      "removed": [],
      "modified": []
    }
  ],
  "head_commit": {
    "id": "1111111111111111111111111111111111111111",
    "message": "Synthetic fixture: add webhook handler",
    "timestamp": "2026-09-29T00:00:00Z",
    "url": "https://example.com/synthetic/demo/commit/example",
    "author": {
      "name": "Synthetic Developer",
      "email": "[email protected]"
    },
    "committer": {
      "name": "Synthetic Developer",
      "email": "[email protected]"
    },
    "added": [
      "webhook.js"
    ],
    "removed": [],
    "modified": []
  }
}
'

Receiver checks and limits

Check ref before running branch-specific automation; tag refs have different semantics.
Test branch deletion separately: head_commit can be null. Do not assume every push has a commit to process.
Use the delivery identifier for duplicate handling, and verify the raw body signature in your own receiver.

Official sources

Documentation reviewed 2026-09-29. Provider contracts can change; consult these references for complete fields.

GitHub: webhook events, headers and push payload

Read the GitHub testing guide