Webhooks

A webhook sends a POST to an address of yours when something happens to packages you choose: to start a deployment, open a pull request, or post in a chat channel.

Before you start

You need an https:// address that accepts POST requests, or a Slack or Discord channel's incoming webhook URL. Webhooks of a team live in the organisation: your organisation → Webhooks, same pages.

Add a webhook

1. Open Settings → Webhooks and then Add a webhook.
2. Enter the Payload URL (1).
3. Choose the Format (2): JSON (signed) for your own server, Slack or Discord for a channel.
4. Tick the Events (3): New versions, Security notices, Withdrawn packages.
5. Choose the Packages (4): the packages you watch, the packages you list by Composer name, or every package (one delivery per repository build).
6. Select Add webhook (5).

For JSON webhooks the page then shows the signing secret once: copy it to your server.

Verify a JSON delivery

Each JSON delivery carries the header X-MeteorGPL-Signature: sha256=<HMAC-SHA256 of the body with your secret>. Compute the same HMAC over the raw body and compare before you trust the payload. The body names the event and, per package, its Composer name, title, type, the new versions, a link and the install command.

Your webhooks

Each webhook shows its address and format with its state: Active, Paused, or Switched off after failures (1); then its events and packages (2).

• Send a test (3) sends a ping delivery at once.
• Pause and Switch on stop and resume deliveries; Remove deletes the webhook.
• Recent deliveries (4) shows each delivery with its result, the HTTP status your server answered and the number of attempts; Deliver again repeats one.

A failed delivery is tried again later: six attempts in all, spread over about 15 hours. After 20 failures in a row the webhook is switched off and you are told; fix the endpoint and select Switch on.