Receive an pull.synchronized event
Beta: webhook event coverage and payload schemas may evolve. See /docs/integrations/webhooks for supported events and delivery limits. An authoritative local head observation changes an existing PR head. Base-only, unchanged and replayed observations emit nothing. The observed ordinal is a watermark; an observing reader is not attributed as the Git writer. GitCafe POSTs an immutable version 1 snapshot to an eligible active endpoint. Verify the timestamp and HMAC-SHA256 over timestamp + '.' + the unchanged UTF-8 request body using the indicated current signing-key generation. The signature value is sha256=<lowercase hex>. Retries reuse body and delivery identity but refresh timestamp and signing key. Delivery attempts are at least once; deduplicate by the signed body event id within each receiver subscription. The delivery header is an inspection identifier and is not covered by the signature. No ordering is promised. A 2xx response acknowledges acceptance. Network failures, 408, 425, 429 and 5xx retry within eight attempts or 24 hours; redirects and other statuses terminate. Retry-After is capped at one hour. See /docs/integrations/webhooks for configuration and failure recovery. This contract does not prove deployed transport qualification.
Headers
The supported event type.
Stable delivery identifier for inspection. Deduplicate using the signed body event id.
Unix seconds for this attempt. Check an appropriate receiver replay window before acceptance.
Current signing-key generation used for this attempt.
HMAC-SHA256 of timestamp + '.' + exact request body bytes. Compare in constant time.
Payload
Response
The receiver accepted the event. Any 2xx status has this meaning.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.