{"meta":{"title":"REST API endpoints for organization webhooks","intro":"Use the REST API to interact with webhooks in an organization.","product":"REST API","breadcrumbs":[{"href":"/en/rest","title":"REST API"},{"href":"/en/rest/orgs","title":"Organizations"},{"href":"/en/rest/orgs/webhooks","title":"Webhooks"}],"documentType":"article"},"body":"# REST API endpoints for organization webhooks\n\nUse the REST API to interact with webhooks in an organization.\n\n## About organization webhooks\n\nOrganization webhooks allow your server to receive HTTP `POST` payloads whenever certain events happen in an organization. For more information, see [Webhooks documentation](/en/webhooks).\n\n> \\[!NOTE]\n> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.\n\n## List organization webhooks\n\n```\nGET /orgs/{org}/hooks\n```\n\nList webhooks for an organization.\nThe authenticated user must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`per_page`** (integer)\n  The number of results per page (max 100). For more information, see \"Using pagination in the REST API.\"\n  Default: `30`\n\n* **`page`** (integer)\n  The page number of the results to fetch. For more information, see \"Using pagination in the REST API.\"\n  Default: `1`\n\n### HTTP response status codes\n\n* **200** - OK\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/hooks\n```\n\n**Response schema (Status: 200):**\n\nArray of `Org Hook`:\n\n* `id`: required, integer\n* `url`: required, string, format: uri\n* `ping_url`: required, string, format: uri\n* `deliveries_url`: string, format: uri\n* `name`: required, string\n* `events`: required, array of string\n* `active`: required, boolean\n* `config`: required, object:\n  * `url`: string\n  * `insecure_ssl`: string\n  * `content_type`: string\n  * `secret`: string\n* `updated_at`: required, string, format: date-time\n* `created_at`: required, string, format: date-time\n* `type`: required, string\n\n## Create an organization webhook\n\n```\nPOST /orgs/{org}/hooks\n```\n\nCreate a hook that posts payloads in JSON format.\nYou must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or\nedit webhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n#### Body parameters\n\n* **`name`** (string) (required)\n  Must be passed as \"web\".\n\n* **`config`** (object) (required)\n  Key/value pairs to provide settings for this webhook.\n  * **`url`** (string) (required)\n    The URL to which the payloads will be delivered.\n  * **`content_type`** (string)\n    The media type used to serialize the payloads. Supported values include json and form. The default is form.\n  * **`secret`** (string)\n    If provided, the secret will be used as the key to generate the HMAC hex digest value for delivery signature headers.\n  * **`insecure_ssl`** (string or number)\n    Determines whether the SSL certificate of the host for url will be verified when delivering payloads. Supported values include 0 (verification is performed) and 1 (verification is not performed). The default is 0. We strongly recommend not setting this to 1 as you are subject to man-in-the-middle and other attacks.\n  * **`username`** (string)\n  * **`password`** (string)\n\n* **`events`** (array of strings)\n  Determines what events the hook is triggered for. Set to \\[\"\\*\"] to receive all possible events.\n  Default: `push`\n\n* **`active`** (boolean)\n  Determines if notifications are sent when the webhook is triggered. Set to true to send notifications.\n  Default: `true`\n\n### HTTP response status codes\n\n* **201** - Created\n\n* **404** - Resource not found\n\n* **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/orgs/ORG/hooks \\\n  -d '{\n  \"name\": \"web\",\n  \"active\": true,\n  \"events\": [\n    \"push\",\n    \"pull_request\"\n  ],\n  \"config\": {\n    \"url\": \"http://example.com/webhook\",\n    \"content_type\": \"json\"\n  }\n}'\n```\n\n**Response schema (Status: 201):**\n\n* `id`: required, integer\n* `url`: required, string, format: uri\n* `ping_url`: required, string, format: uri\n* `deliveries_url`: string, format: uri\n* `name`: required, string\n* `events`: required, array of string\n* `active`: required, boolean\n* `config`: required, object:\n  * `url`: string\n  * `insecure_ssl`: string\n  * `content_type`: string\n  * `secret`: string\n* `updated_at`: required, string, format: date-time\n* `created_at`: required, string, format: date-time\n* `type`: required, string\n\n## Get an organization webhook\n\n```\nGET /orgs/{org}/hooks/{hook_id}\n```\n\nReturns a webhook configured in an organization. To get only the webhook\nconfig properties, see \"Get a webhook configuration for an organization.\nYou must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`hook_id`** (integer) (required)\n  The unique identifier of the hook. You can find this value in the X-GitHub-Hook-ID header of a webhook delivery.\n\n### HTTP response status codes\n\n* **200** - OK\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/hooks/HOOK_ID\n```\n\n**Response schema (Status: 200):**\n\nSame response schema as [Create an organization webhook](#create-an-organization-webhook).\n\n## Update an organization webhook\n\n```\nPATCH /orgs/{org}/hooks/{hook_id}\n```\n\nUpdates a webhook configured in an organization. When you update a webhook,\nthe secret will be overwritten. If you previously had a secret set, you must\nprovide the same secret or set a new secret or the secret will be removed. If\nyou are only updating individual webhook config properties, use \"Update a webhook\nconfiguration for an organization\".\nYou must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`hook_id`** (integer) (required)\n  The unique identifier of the hook. You can find this value in the X-GitHub-Hook-ID header of a webhook delivery.\n\n#### Body parameters\n\n* **`config`** (object)\n  Key/value pairs to provide settings for this webhook.\n  * **`url`** (string) (required)\n    The URL to which the payloads will be delivered.\n  * **`content_type`** (string)\n    The media type used to serialize the payloads. Supported values include json and form. The default is form.\n  * **`secret`** (string)\n    If provided, the secret will be used as the key to generate the HMAC hex digest value for delivery signature headers.\n  * **`insecure_ssl`** (string or number)\n    Determines whether the SSL certificate of the host for url will be verified when delivering payloads. Supported values include 0 (verification is performed) and 1 (verification is not performed). The default is 0. We strongly recommend not setting this to 1 as you are subject to man-in-the-middle and other attacks.\n\n* **`events`** (array of strings)\n  Determines what events the hook is triggered for.\n  Default: `push`\n\n* **`active`** (boolean)\n  Determines if notifications are sent when the webhook is triggered. Set to true to send notifications.\n  Default: `true`\n\n* **`name`** (string)\n\n### HTTP response status codes\n\n* **200** - OK\n\n* **404** - Resource not found\n\n* **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X PATCH \\\n  https://api.github.com/orgs/ORG/hooks/HOOK_ID \\\n  -d '{\n  \"active\": true,\n  \"events\": [\n    \"pull_request\"\n  ]\n}'\n```\n\n**Response schema (Status: 200):**\n\nSame response schema as [Create an organization webhook](#create-an-organization-webhook).\n\n## Delete an organization webhook\n\n```\nDELETE /orgs/{org}/hooks/{hook_id}\n```\n\nDelete a webhook for an organization.\nThe authenticated user must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`hook_id`** (integer) (required)\n  The unique identifier of the hook. You can find this value in the X-GitHub-Hook-ID header of a webhook delivery.\n\n### HTTP response status codes\n\n* **204** - No Content\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X DELETE \\\n  https://api.github.com/orgs/ORG/hooks/HOOK_ID\n```\n\n**Response schema (Status: 204):**\n\n## Get a webhook configuration for an organization\n\n```\nGET /orgs/{org}/hooks/{hook_id}/config\n```\n\nReturns the webhook configuration for an organization. To get more information about the webhook, including the active state and events, use \"Get an organization webhook .\"\nYou must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`hook_id`** (integer) (required)\n  The unique identifier of the hook. You can find this value in the X-GitHub-Hook-ID header of a webhook delivery.\n\n### HTTP response status codes\n\n* **200** - OK\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/hooks/HOOK_ID/config\n```\n\n**Response schema (Status: 200):**\n\n* `url`: string, format: uri\n* `content_type`: string\n* `secret`: string\n* `insecure_ssl`: one of:\n  * **string**\n  * **number**\n\n## Update a webhook configuration for an organization\n\n```\nPATCH /orgs/{org}/hooks/{hook_id}/config\n```\n\nUpdates the webhook configuration for an organization. To update more information about the webhook, including the active state and events, use \"Update an organization webhook .\"\nYou must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`hook_id`** (integer) (required)\n  The unique identifier of the hook. You can find this value in the X-GitHub-Hook-ID header of a webhook delivery.\n\n#### Body parameters\n\n* **`url`** (string)\n  The URL to which the payloads will be delivered.\n\n* **`content_type`** (string)\n  The media type used to serialize the payloads. Supported values include json and form. The default is form.\n\n* **`secret`** (string)\n  If provided, the secret will be used as the key to generate the HMAC hex digest value for delivery signature headers.\n\n* **`insecure_ssl`** (string or number)\n  Determines whether the SSL certificate of the host for url will be verified when delivering payloads. Supported values include 0 (verification is performed) and 1 (verification is not performed). The default is 0. We strongly recommend not setting this to 1 as you are subject to man-in-the-middle and other attacks.\n\n### HTTP response status codes\n\n* **200** - OK\n\n### Code examples\n\n#### Update an existing webhook\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X PATCH \\\n  https://api.github.com/orgs/ORG/hooks/HOOK_ID/config \\\n  -d '{\n  \"url\": \"http://example.com/webhook\",\n  \"content_type\": \"json\",\n  \"insecure_ssl\": \"0\",\n  \"secret\": \"********\"\n}'\n```\n\n**Response schema (Status: 200):**\n\nSame response schema as [Get a webhook configuration for an organization](#get-a-webhook-configuration-for-an-organization).\n\n## List deliveries for an organization webhook\n\n```\nGET /orgs/{org}/hooks/{hook_id}/deliveries\n```\n\nReturns a list of webhook deliveries for a webhook configured in an organization.\nYou must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`hook_id`** (integer) (required)\n  The unique identifier of the hook. You can find this value in the X-GitHub-Hook-ID header of a webhook delivery.\n\n* **`per_page`** (integer)\n  The number of results per page (max 100). For more information, see \"Using pagination in the REST API.\"\n  Default: `30`\n\n* **`cursor`** (string)\n  Used for pagination: the starting delivery from which the page of deliveries is fetched. Refer to the link header for the next and previous page cursors.\n\n* **`status`** (string)\n  Returns webhook deliveries filtered by delivery outcome classification based on status\\_code range. A status of success returns deliveries with a status\\_code in the 200-399 range (inclusive). A status of failure returns deliveries with a status\\_code in the 400-599 range (inclusive).\n  Can be one of: `success`, `failure`\n\n### HTTP response status codes\n\n* **200** - OK\n\n* **400** - Bad Request\n\n* **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/hooks/HOOK_ID/deliveries\n```\n\n**Response schema (Status: 200):**\n\nArray of `Simple webhook delivery`:\n\n* `id`: required, integer, format: int64\n* `guid`: required, string\n* `delivered_at`: required, string, format: date-time\n* `redelivery`: required, boolean\n* `duration`: required, number\n* `status`: required, string\n* `status_code`: required, integer\n* `event`: required, string\n* `action`: required, string or null\n* `installation_id`: required, integer or null, format: int64\n* `repository_id`: required, integer or null, format: int64\n* `throttled_at`: string or null, format: date-time\n\n## Get a webhook delivery for an organization webhook\n\n```\nGET /orgs/{org}/hooks/{hook_id}/deliveries/{delivery_id}\n```\n\nReturns a delivery for a webhook configured in an organization.\nYou must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`hook_id`** (integer) (required)\n  The unique identifier of the hook. You can find this value in the X-GitHub-Hook-ID header of a webhook delivery.\n\n* **`delivery_id`** (integer) (required)\n\n### HTTP response status codes\n\n* **200** - OK\n\n* **400** - Bad Request\n\n* **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/hooks/HOOK_ID/deliveries/DELIVERY_ID\n```\n\n**Response schema (Status: 200):**\n\n* `id`: required, integer\n* `guid`: required, string\n* `delivered_at`: required, string, format: date-time\n* `redelivery`: required, boolean\n* `duration`: required, number\n* `status`: required, string\n* `status_code`: required, integer\n* `event`: required, string\n* `action`: required, string or null\n* `installation_id`: required, integer or null\n* `repository_id`: required, integer or null\n* `throttled_at`: string or null, format: date-time\n* `url`: string\n* `request`: required, object:\n  * `headers`: required, object or null, additional properties allowed\n  * `payload`: required, object or null, additional properties allowed\n* `response`: required, object:\n  * `headers`: required, object or null, additional properties allowed\n  * `payload`: required, string or null, additional properties allowed\n\n## Redeliver a delivery for an organization webhook\n\n```\nPOST /orgs/{org}/hooks/{hook_id}/deliveries/{delivery_id}/attempts\n```\n\nRedeliver a delivery for a webhook configured in an organization.\nYou must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`hook_id`** (integer) (required)\n  The unique identifier of the hook. You can find this value in the X-GitHub-Hook-ID header of a webhook delivery.\n\n* **`delivery_id`** (integer) (required)\n\n### HTTP response status codes\n\n* **202** - Accepted\n\n* **400** - Bad Request\n\n* **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/orgs/ORG/hooks/HOOK_ID/deliveries/DELIVERY_ID/attempts\n```\n\n**Response schema (Status: 202):**\n\nobject\n\n## Ping an organization webhook\n\n```\nPOST /orgs/{org}/hooks/{hook_id}/pings\n```\n\nThis will trigger a ping event\nto be sent to the hook.\nYou must be an organization owner to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need admin:org\\_hook scope. OAuth apps cannot list, view, or edit\nwebhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n* **`hook_id`** (integer) (required)\n  The unique identifier of the hook. You can find this value in the X-GitHub-Hook-ID header of a webhook delivery.\n\n### HTTP response status codes\n\n* **204** - No Content\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/orgs/ORG/hooks/HOOK_ID/pings\n```\n\n**Response schema (Status: 204):**"}