| title | Organization webhooks | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| allowTitleToDifferFromFilename | true | ||||||||
| shortTitle | Webhooks | ||||||||
| intro | |||||||||
| versions |
|
||||||||
| topics |
|
||||||||
| miniTocMaxHeadingLevel | 3 |
Organization webhooks allow you to receive HTTP POST payloads whenever certain events happen in an organization. {% data reusables.webhooks.webhooks-rest-api-links %}
For more information on actions you can subscribe to, see "{% data variables.product.prodname_dotcom %} event types."
All actions against organization webhooks require the authenticated user to be an admin of the organization being managed. Additionally, OAuth tokens require the admin:org_hook scope. For more information, see "Scopes for OAuth Apps."
In order to protect sensitive data which may be present in webhook configurations, we also enforce the following access control rules:
- OAuth applications cannot list, view, or edit webhooks which they did not create.
- Users cannot list, view, or edit webhooks which were created by OAuth applications.
In order for {% data variables.product.product_name %} to send webhook payloads, your server needs to be accessible from the Internet. We also highly suggest using SSL so that we can send encrypted payloads over HTTPS.
For more best practices, see our guide.
{% data variables.product.product_name %} will send along several HTTP headers to differentiate between event types and payload identifiers. See webhook headers for details.