Webhooks

Documentation Index

Fetch the complete documentation index at: https://docs.gorules.io/llms.txt

Use this file to discover all available pages before exploring further.

​

Webhook list

​

List columns

​

Webhook types

​

REST Webhook

• URL: The endpoint that receives webhook payloads
• Signing secret: Generated automatically for payload verification

​

GitHub

• Repository: Select from connected GitHub repositories
• Target Branch: Branch to dispatch the workflow on (e.g., main)
• Workflow ID: The workflow filename or ID (e.g., deploy.yml or 12345678)

​

GitLab

• Repository: Select from connected GitLab repositories

​

Available events

​

Commits (main branch)

​

Releases

​

Change Requests

​

Creating a webhook

1. Go to Settings → Webhooks
2. Click “Create webhook”
3. Enter a description
4. Select the webhook type (REST Webhook, GitHub, or GitLab)
5. Configure the target:
   • For REST: Enter the destination URL
   • For GitHub/GitLab: Select repository and workflow details
6. Select the events to listen for
7. Click “Create”

​

Signing secret

​

Testing webhooks

1. Open the create or update webhook form
2. In the “Test Webhook” section, select an event type
3. Click “Send Test”

​

Webhook logs

​

Accessing logs

1. Go to Settings → Webhooks
2. Click “View Logs” on the webhook row

​

Log details

​

Expanded log view

• URL: The destination endpoint
• Payload: JSON data sent to the endpoint
• Headers: Request headers including authentication

• Status code: HTTP response code (e.g., 204)
• Body: Response content from the endpoint
• Completion time: Request duration in milliseconds

​

Retrying failed deliveries

​

Managing webhooks

​

Updating a webhook

1. Click the three-dot menu on the webhook row
2. Select “Update”
3. Modify the configuration
4. Click “Update”

​

Enabling or disabling

​

Deleting a webhook

1. Click the three-dot menu on the webhook row
2. Select “Delete”
3. Confirm the deletion

​

Webhook payload

​

Payload structure

{
  "eventId": "dea48f7b-2cca-4113-a00d-eb8c0fb06a5d",
  "eventType": "release.created",
  ...
}

​

Request headers

​

Verifying webhook signatures

​

Signature format

​

Node.js example

const crypto = require('crypto');

const WEBHOOK_SECRET = 'your_webhook_secret';

function verifyWebhookSignature(receivedSignature, rawBody, secret) {
    if (!receivedSignature || !rawBody || !secret) {
        return false;
    }

    try {
        // Extract the hash part from 'sha256=<hash>' format
        const signatureHash = receivedSignature.split('=')[1] || receivedSignature;

        const hmac = crypto.createHmac('sha256', secret);
        hmac.update(rawBody);
        const expectedSignature = hmac.digest('hex');

        // Use timing-safe comparison to prevent timing attacks
        return crypto.timingSafeEqual(
            Buffer.from(signatureHash, 'hex'),
            Buffer.from(expectedSignature, 'hex')
        );
    } catch (error) {
        console.error('Signature verification error:', error);
        return false;
    }
}

// Express route handler
router.post('/webhook', async (req, res) => {
    const signature = req.headers['x-webhook-signature'];
    const rawBody = req.rawBody;

    // Verify signature
    if (!verifyWebhookSignature(signature, rawBody, WEBHOOK_SECRET)) {
        return res.status(401).send('Unauthorized');
    }

    // Process webhook
    const payload = req.body;
    console.log('Valid webhook:', payload.eventType);

    res.status(200).send('OK');
});

app.use(express.json({
    verify: (req, res, buf) => {
        req.rawBody = buf.toString();
    }
}));

​

Verification steps

1. Extract the X-Webhook-Signature header from the request
2. Get the raw request body (before JSON parsing)
3. Compute HMAC-SHA256 of the raw body using your signing secret
4. Compare the computed hash with the received signature using a timing-safe comparison
5. Reject the request if signatures don’t match