API and webhooks to integrate GitHub with DevLog AI.
This reference covers public endpoints, expected headers, signature validation, and primary responses for configuring or automating integrations.
Receive events at an endpoint isolated by workspace.
POST /webhooks/github/{workspaceUuid}
Content-Type: application/json
X-GitHub-Event: push
X-GitHub-Delivery: 8189e9a8-43cc-11f1-8719-a9d9d4b439df
X-Hub-Signature-256: sha256=...
workspaceUuid
Public workspace identifier, shown in the authenticated user dashboard.
Secret
Configure the workspace Secret in GitHub to generate the HMAC SHA-256 signature.
Payload
The JSON body is stored in sanitized form and appears in the private workspace history.
An invalid signature must fail before the event is stored.
expected = "sha256=" + HMAC_SHA256(rawBody, workspaceSecret) valid = hash_equals(expected, X-Hub-Signature-256)
If the signature is absent or does not match, the endpoint returns 401 and the payload does not enter the workspace.
200 OK
{"ok": true, "id": 123}Event accepted, validated, and stored.
401 Unauthorized
{"error": "Assinatura GitHub invalida."}Incorrect Secret or missing signature.
429 Too Many Requests
{"error": "Limite mensal de eventos atingido."}Workspace reached its plan limit.
The production path uses a GitHub App.
POST /webhooks/github-app X-GitHub-Event: push X-Hub-Signature-256: sha256=...
The GitHub App endpoint validates the app-wide Secret, finds the installation through installation.id, and stores the event in the linked workspace.
Billing receives signed provider notifications.
POST /webhooks/mercado-pago x-signature: ... x-request-id: ...
This endpoint processes payments, subscriptions, and usage invoices when the webhook Secret is configured.
Use HTTPS
Production webhooks must target the official domain with active TLS.
Rotate Secrets
If exposure is suspected, generate a new Secret in the dashboard and update GitHub.
Avoid unnecessary data
Review events and repositories to avoid sending payloads beyond what is necessary.
Code samples, header names, event names, and signatures remain verbatim across locales.