---
title: "Accept one signed GitHub App delivery"
method: POST
path: "/github/webhook"
tags: ["github"]
---

# Accept one signed GitHub App delivery

`POST /github/webhook`

## Request

- Base URL: `https://app.nerdit.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.nerdit.ai/github/webhook`
- Auth: none declared

Verify, record, acknowledge — in that order, and nothing else.

No session and no CSRF: the request carries no cookie, so the
middleware passes it through, and the signature is the entire
admission decision. The side effects happen off this request, from
the row, so GitHub's ten-second delivery window never contains a
tunnel round trip.

## Response `202`

Successful Response

- GitHubWebhookAck: The ``202`` every verified delivery gets, whatever happens next.
  - `status` 'accepted' | 'duplicate', required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `404`: Not Found
- `413`: Content Too Large

---

[API](https://skmtc.dev/nerdit/apis/nerdit-cloud-web.md) · [All operations](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/llms.txt) · [OpenAPI document](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/revisions/06e3b44b58be?raw)