A client says the automation fired, or says the other repository never heard the push. Tonight, three proofs, in a repository the agency or the client can open. Name the hook that repository called: the hook id, the events, and the url. If the list is empty, write that, and do not invent a delivery to fill the hole. Show a different hook whose id, or whose events, are not this one. Show another client's repository that does not list this hook. If any of the three needs the person who pasted the secret and then left, you have not named the hook. You have a slide of a payload and a guess.
This is one repository webhook. It is not the release a tag named. Which release did that tag name? is a release id, a tag, and a draft flag. A release can exist while this hook's last response is unused. It is not the app an install granted. Which app did that install grant? is an installation id and a permission. An installation can be active while this hook's url is a different host. It is not the ruleset a push hit. Which ruleset did that push hit? is a ruleset id. A ruleset can block a push that a hook would also have received, and the ruleset id is not the hook id. It is not the Stripe endpoint an event hit. Which webhook did that event hit? is a processor delivery. A GitHub hook id is not that endpoint. It is not the setup a customer confirmed, and it is not the job a fine-tune finished. Which setup did the customer confirm? is a setup id. Which job did that fine-tune finish? is a fine-tuning job id.
None of what follows is a promise about this client's repository, and none of it is legal advice. The fields below are the current samples on GitHub's repository webhook pages. Several of those samples share an id and do not share a meaning. The percentages below that are a 2023 study of workflows and security policies on popular GitHub repositories. A share of other people's workflows is not the hook id on the repository you opened tonight.
The list sample and the create sample print the same hook. The id is 12345678. 8 digits. type is Repository. name is web. active is true. events are push and pull_request. push is 4 characters. pull_request is 12. content_type is json. 4 characters. The parameter text says the default content_type is form. form is also 4 characters, and it is not json. insecure_ssl is the string 0. The parameter text says the type is string or number, and that the default is 0. The sample stores the string. The url is https://example.com/webhook. 27 characters. created_at and updated_at are both 2019-06-03T00:57:16Z. The difference is 0 seconds. last_response.code is null. last_response.status is unused. 6 characters. last_response.message is null. The create request sends the same two events. The parameter text says the default events array is push alone. The sample sends two. Create returns 201. The list returns 200. The account in the url is octocat. 7 characters. The repository is Hello-World. 11 characters. The hook url is https://api.github.com/repos/octocat/Hello-World/hooks/12345678. 63 characters. Every sample curl on the page sends X-GitHub-Api-Version 2026-03-10. 10 characters. The sample hook was created in 2019. 2026 minus 2019 is 7. The version header is not the created year (GitHub, REST API endpoints for repository webhooks).
The update sample asks to add pull_request and then prints a hook that already had pull_request. updated_at is still 2019-06-03T00:57:16Z. The add did not move the clock in the sample. The response status is 200, not the create status 201. The config endpoint, for the same hook id, returns four fields: content_type json, insecure_ssl 0, secret **, and the same url. The secret mask is 8** asterisks. The hook object above does not include secret. Do not treat the hook object as the configuration. The update-config request sends content_type and url and does not send secret, and the response still prints the eight asterisks.
Delete is the heading that disagrees with the path. The heading says delete a webhook for an organization. The path is /repos/{owner}/{repo}/hooks/{hook_id}. The status is 204. Ping is also 204. Redeliver is 202. The test endpoint is 204, and the note says that if the hook is not subscribed to push, the server still responds 204 and generates no test POST. The sample events include push, so this sample is subscribed. A hook whose only event was pull_request would get the same status and no POST. 204 is not evidence that a payload left.
The delivery list is a second object that reuses the first id. The first delivery id is 12345678, the same 8 digits as the hook. The second delivery id is 123456789. 9 digits. The difference is 111111111. Both deliveries print the same guid, 0b989ba4-242f-11e5-81e1-c7b6966d2516. 36 characters. The first redelivery flag is false, duration 0.27, throttled_at equal to delivered_at. The second redelivery flag is true, duration 0.28, throttled_at null. 0.28 minus 0.27 is 0.01 seconds, which is 10 milliseconds. The delivered_at values are 2019-06-03T00:57:16Z and 2019-06-04T00:57:16Z. That is 86400 seconds, one day, on the same clock. status is OK and status_code is 200. OK is not unused, and 200 is not null. event is issues. 6 characters. issues is not push and not pull_request. action is opened. 6 characters, the same length as issues, a different word. installation_id is 123. repository_id is 456. 456 minus 123 is 333, which the sample does not print.
The single-delivery sample keeps id 12345678 and then disagrees with the list. Its url is https://www.example.com. 23 characters, not 27, and it is a different host: www is present, and /webhook is absent. The request header X-GitHub-Hook-ID is 42. 2 characters. 42 is not 12345678. X-GitHub-Event is issues, which matches the delivery event and does not match the hook's push or pull_request. The payload repository id is 123, which matches installation_id and does not match repository_id 456. The response payload is the two characters ok. The issue body is foo. 3 characters. X-Hub-Signature-256 is sha256=6dcb09b5b57875f334f61aebed695e2e4193db5e. 47 characters. The hex after the prefix is 40. X-Hub-Signature is sha1=a84d88e7554fc1fa21bcbc4efae3c782a70d2b9d. 45 characters. That hex is also 40. The prefixes are 7 and 5. content-type on the request is application/json. 16 characters. Content-Type on the response is text/html;charset=utf-8. 23 characters. A delivery that returns HTML is not the json content_type on the hook.
Ayala and Garcia measured workflows and security policies, which are not this hook. They queried the top 100 and the top 1000 repositories from 181 trending topics, and the top 4900 repositories overall. After 6 of those 4900 were gone, the table's population is 4894. 4900 minus 6 is 4894. The top-1000-per-topic figure they print is 168222 projects. 168222 plus 4894 is 173116. The abstract calls that just over 173 thousand. 173116 minus 173000 is 116, which the abstract does not print. On that combined set they print 37% with a workflow and 7% with a security policy. Figure 1(b), the top 1000 per topic, prints means of 36%, 7%, and 5%. 36 is not 37. They also print a 14% increase over Chen's nearly 22%. 22 plus 14 is 36, the figure mean, not the abstract's 37. Figure 1(a), 17827 projects, prints means of 55%, 16%, and 13%. The workflow-count means are 4.44 and 2.87. Chen's average was 2.8. 2.87 minus 2.8 is 0.07, which the paper does print. Table I, on the 4894, prints 51%, 19%, 16%, and an average of 4.46 workflows. 4.46 minus 4.44 is 0.02, which the paper does not print.
The language sample is 60 repositories times 34 languages, which is 2040. They print 57% with a workflow, 17% with a security policy, and a mean of 4.24 workflows. 4.24 minus 2.8 is 1.44, which the paper prints as the increase since Chen. 57 minus 37 is 20, which the paper does not print. Table II lists ten CodeQL languages: C 10%, C++ 10%, C# 10%, Go 35%, Java 11.7%, JavaScript 15%, Kotlin 1.7%, Python 10%, Ruby 21.7%, TypeScript 10%. The sum is 135.1. Divided by 10 that is 13.51. The paper prints 13.5%. 60 times 10 languages is 600. 13.5% of 600 is 81. 13.51% of 600 is 81.06, which the paper does not print. 35% of 60 is 21. 10% of 60 is 6. 1.7% of 60 is 1.02, not an integer, and the paper does not print 1.02. GitHub Actions, the paper says, was introduced in 2019. The measurement is December 2022. 2022 minus 2019 is 3. The arXiv stamp is 25 May 2023. 2023 minus 2019 is 4, which is not the measurement gap. None of these percentages is hook id 12345678, and none of them is event issues (Jessy Ayala and Joshua Garcia, An Empirical Study on Workflows and Security Policies in Popular GitHub Repositories).
The Punjab training application is an offline-first client build, distinct from the next client's repository. It is not a webhook ledger. No headcount, duration, or result figure belongs in that sentence. Government of Punjab does not supply hook 12345678.
When the repository is real and the agency cannot name the hook, the missing object is specific. A page the agency or the client can open, that shows one hook id, one event list, and one url, shows a different hook that is not that one, and shows another client's repository without it. A white label software development partner that expects this will have that page on the client's repository, under the client's account, before a missed push is the way anyone discovers the url. One that needs a call in order for the client to see which hook is stored is telling you who holds the id. If the first slice is a fixed capability, an AI integration sprint is the shape where the acceptance sentence can include the three proofs. If you do not yet know which repository receives the event, a two-week AI readiness assessment maps the systems. The findings are yours.
There is a version of this engagement the agency should not take. The work is not sold under the agency's name. The client asked to meet the builders. The room only has a slide. The buyer only wants a template. Or the buyer wants a legal opinion about a payload. 37% is not your hook, and 12345678 is not your client's id. A delivery event of issues, on a hook whose events are push and pull_request, is a disagreement to write down. It is not a reason to invent a third event.
Before you tell the client which hook the repository called, do the three proofs and write the name. Name the id, the events, and the url, or write that the list was empty. Show a different hook that is not that one. Show another client's repository that does not list it. Do not treat a 204 as a payload, and do not treat a workflow percentage as a hook id. The binding is the hook you can defend.
Questions
Three records, in a repository the agency or the client can open. The hook id, the events, and the url, or a written line that the list was empty. A different hook whose id or events are not this one. Another client's repository that does not list this hook. If the delivery event is not in the hook's event list, write both.
No. A percentage of other people's workflows is not the id on this hook. A hook you can defend is the id, the events, and the url on this repository, or a written line that no hook was stored. 37% in one study is not event push, and 12345678 on a sample is not your client's hook.
When the work is not sold under the agency's name, when the client asked to meet the builders, when the room only has a slide, when the buyer only wants a template, or when the buyer wants a legal opinion.
Find this useful? Tell Google to show you more of it.