> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub Webhooks

> Send GitHub repository and organization webhooks to your Sazabi intake URL to search pushes, pull requests, issues, and workflow runs as log records, with every delivery's signature verified.

[All GitHub integration capabilities](https://docs.sazabi.com/catalogs/integrations/github.md)

## About

Send GitHub webhooks to Sazabi to search pushes, pull requests, issues, workflow runs, deployments, and security alerts next to the rest of your production telemetry. GitHub posts each event to your Sazabi intake URL as a JSON `POST`, signed with the webhook's secret. There is no agent to deploy, and Sazabi never calls the GitHub API.

### What Sazabi records

Each GitHub delivery becomes one Sazabi record that keeps the full payload. These attributes are extracted for filtering:

| Attribute | Source |
| - | - |
| `github.webhook.event` | `X-GitHub-Event` header |
| `github.webhook.delivery_id` | `X-GitHub-Delivery` header |
| `github.webhook.hook_id` | `X-GitHub-Hook-ID` header |
| `github.webhook.action` | `action` |
| `github.repository.full_name` | `repository.full_name` |
| `github.organization.login` | `organization.login` |
| `github.sender.login` | `sender.login` |
| `github.installation.id` | `installation.id` |

## Prerequisites

* Admin access to the repository or organization whose webhooks you configure.
* Your Sazabi intake URL.
* A verification secret. Sazabi can generate one, or you can choose your own.

> [!NOTE]
>
> Signature verification is in early access. While it is on for your organization, Sazabi asks for the verification secret before it creates the intake URL, and rejects any delivery whose signature does not match. Contact support to turn it on.

## Set up in the dashboard

**Step 1**

### Add the log source

In the dashboard, open **Settings > Log sources**, choose **GitHub Webhooks** and add it. If Sazabi asks for a verification secret, let it generate one or paste your own, then copy the generated secret. It is shown once.

**Step 2**

### Add the webhook in GitHub

In the repository or organization on [GitHub](https://github.com), go to the **Webhooks** page of its settings and click **Add webhook**.

* **Payload URL**: Paste your Sazabi intake URL.
* **Content type**: `application/json`.
* **Secret**: Paste the verification secret.
* **Which events would you like to trigger this webhook?**: Choose the events to send, or everything.

**Step 3**

### Save and verify

Save the webhook. GitHub sends a `ping` event right away; it appears under **Recent Deliveries** with the response Sazabi returned.

## Set up with the CLI

You can also register the GitHub Webhooks log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

```bash theme={"system"}
sazabi log-sources create github_webhooks --mode manual --verify-signatures github --generate-secret
```

The command prints the intake URL and, once, the generated secret. Paste the URL into the webhook's **Payload URL** and the secret into **Secret**. To use a secret you already have, pipe it in instead of generating one:

```bash theme={"system"}
printf '%s' "$GITHUB_WEBHOOK_SECRET" | sazabi log-sources create github_webhooks --mode manual --verify-signatures github --secret-stdin
```

Run `sazabi log-sources get <log-source-id>` at any time to reprint the endpoint, or `sazabi log-sources list` to see every log source in the project.

## Verify signatures

GitHub signs every delivery with the webhook's secret and sends the result in the `X-Hub-Signature-256` header. Sazabi checks it on the exact bytes GitHub sent and rejects a delivery whose signature does not match with `401`. A rejected delivery is not stored and not billed. GitHub sends no signature for a webhook without a secret, so such a webhook is rejected too.

| Sender | Signature header | Secret | Setup |
| - | - | - | - |
| GitHub | `X-Hub-Signature-256` | Sazabi generates it; you paste it into GitHub | In GitHub, open the webhook's settings and paste the secret Sazabi generated into Secret. |

To change the secret later, open the log source in **Settings > Log sources** and choose **Rotate secret**. The previous secret keeps working for 24 hours by default, so GitHub keeps delivering while you update it. The [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) shows rejected deliveries and why.

## Verify

Push a commit, open an issue, or redeliver the `ping` from the webhook's **Recent Deliveries** tab. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm records from the **GitHub Webhooks** source appear. Records typically arrive within a minute or two.

## Troubleshooting

**`401` in Recent Deliveries** — The signature did not match. Check that the **Secret** in GitHub is exactly the secret Sazabi has, and that the content type is `application/json`. Redeliver from **Recent Deliveries** once fixed.

**`400` in Recent Deliveries** — The body was not JSON. Set the webhook's content type to `application/json`; the default form-encoded type is not accepted.

**No records after saving** — Confirm the **Payload URL** exactly matches your Sazabi intake URL, including the `https://` scheme, and that the webhook is active and subscribed to the events you triggered.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Webhook Events](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/webhook-events.md)
>
> Verify signatures and send webhooks from any other platform.

> [card] [Validating webhook deliveries](https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries)
>
> GitHub's documentation for the signature Sazabi checks.

> [card] [Webhook events and payloads](https://docs.github.com/en/webhooks/webhook-events-and-payloads)
>
> Every event GitHub can send and its payload.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.