Receive an installation.created event

Beta: webhook event coverage and payload schemas may evolve. See /docs/integrations/webhooks for supported events and delivery limits. An organization admin installed the app, and the installation is active. Sent once per installation. For selected repositories it names each one (up to 50); for all repositories it names none. Repositories the installation can no longer read when it is sent are left out; the event is still sent. Adopting a new revision of the app is not a new installation; it sends installation.permissions_accepted instead. Delivered only to the app installation's own webhook, whether or not the manifest lists the event, never to organization or repository endpoints. Pending deliveries of other events are not sent once the app loses access; this event still is, unless GitCafe suspended the app. GitCafe POSTs an immutable version 1 snapshot to an eligible active endpoint. Verify the timestamp and HMAC-SHA256 over timestamp + '.' + the unchanged UTF-8 request body using the indicated current signing-key generation. The signature value is sha256=<lowercase hex>. Retries reuse body and delivery identity but refresh timestamp and signing key. Delivery attempts are at least once; deduplicate by the signed body event id within each receiver subscription. The delivery header is an inspection identifier and is not covered by the signature. No ordering is promised. A 2xx response acknowledges acceptance. Network failures, 408, 425, 429 and 5xx retry within eight attempts or 24 hours; redirects and other statuses terminate. Retry-After is capped at one hour. See /docs/integrations/webhooks for configuration and failure recovery. This contract does not prove deployed transport qualification.