GitHub release published webhook payload example

GitHub · event: release (published) · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into GitHub's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
user-agent: GitHub-Hookshot/8b5a4e2
x-github-event: release
x-github-delivery: a4c2f1e0-85b3-11f1-9d7a-3e5f8c2b6a90
x-github-hook-id: 512403864
x-github-hook-installation-target-type: repository
x-hub-signature: sha1=cd5d4f0a168d5ea1a39615357f868af19fff2538
x-hub-signature-256: sha256=d1733ad21168386b284fecd6a338125ad2a80505e359867e06ca1366b723ede9

Body

{
  "action": "published",
  "release": {
    "url": "https://api.github.com/repos/octocat/hello-world/releases/236713545",
    "html_url": "https://github.com/octocat/hello-world/releases/tag/v2.4.0",
    "assets_url": "https://api.github.com/repos/octocat/hello-world/releases/236713545/assets",
    "upload_url": "https://uploads.github.com/repos/octocat/hello-world/releases/236713545/assets{?name,label}",
    "tarball_url": "https://api.github.com/repos/octocat/hello-world/tarball/v2.4.0",
    "zipball_url": "https://api.github.com/repos/octocat/hello-world/zipball/v2.4.0",
    "id": 236713545,
    "node_id": "RE_kwDOAWl9pM4OGxpJ",
    "tag_name": "v2.4.0",
    "target_commitish": "main",
    "name": "v2.4.0 — retry-safe webhook deliveries",
    "draft": false,
    "prerelease": false,
    "immutable": false,
    "created_at": "2026-08-30T08:55:12Z",
    "published_at": "2026-08-30T09:58:03Z",
    "author": {
      "login": "octocat",
      "id": 583231,
      "node_id": "MDQ6VXNlcjU4MzIzMQ==",
      "avatar_url": "https://avatars.githubusercontent.com/u/583231?v=4",
      "html_url": "https://github.com/octocat",
      "type": "User",
      "site_admin": false
    },
    "assets": [
      {
        "url": "https://api.github.com/repos/octocat/hello-world/releases/assets/198122437",
        "id": 198122437,
        "node_id": "RA_kwDOAWl9pM4LzucF",
        "name": "hello-world_2.4.0_linux_amd64.tar.gz",
        "label": "",
        "content_type": "application/gzip",
        "state": "uploaded",
        "size": 5824512,
        "download_count": 0,
        "created_at": "2026-08-30T09:57:40Z",
        "updated_at": "2026-08-30T09:57:44Z",
        "browser_download_url": "https://github.com/octocat/hello-world/releases/download/v2.4.0/hello-world_2.4.0_linux_amd64.tar.gz",
        "uploader": {
          "login": "octocat",
          "id": 583231,
          "type": "User"
        }
      }
    ],
    "tarball_name": null,
    "zipball_name": null,
    "body": "## What's Changed\r\n* fix: retry webhook deliveries on 5xx by @octocat in #482\r\n\r\n**Full Changelog**: https://github.com/octocat/hello-world/compare/v2.3.1...v2.4.0"
  },
  "repository": {
    "id": 23675664,
    "node_id": "MDEwOlJlcG9zaXRvcnkyMzY3NTY2NA==",
    "name": "hello-world",
    "full_name": "octocat/hello-world",
    "private": false,
    "owner": {
      "login": "octocat",
      "id": 583231,
      "type": "User"
    },
    "html_url": "https://github.com/octocat/hello-world",
    "description": "Example service with webhook-driven releases",
    "fork": false,
    "default_branch": "main"
  },
  "sender": {
    "login": "octocat",
    "id": 583231,
    "type": "User",
    "site_admin": false
  }
}

Things that bite people

This example's signature actually verifies: paste the body, the X-Hub-Signature-256 value and the secret hookden-github-sample-webhook-secret into the signature debugger (GitHub scheme), or set the GitHub scheme on a capture bin. The legacy X-Hub-Signature (HMAC-SHA1) is computed over the same bytes and verifies too — but verify the SHA-256 one.
published vs released vs created (docs as of 2026-08-30): created = a draft was saved, or a release/pre-release was published without ever being a draft. published = a release, pre-release, or draft was published. released = a release was published or a pre-release was promoted to a release — it does not fire when you publish a pre-release (prereleased fires instead). Want "a release went live", exactly once? Filter on action: "published" and branch on release.prerelease.
One click, several deliveries: publishing straight from the new-release form (no draft) fires created + published + released — three webhooks for the same release, seconds apart, identical release.id, different action. Handlers that key on "a release event arrived" triple-run. Dedupe on release.id + action, not on the delivery GUID (which is unique per delivery).
Known gap: publishing a draft as a pre-release does not fire prereleased (long-standing behavior — see GitHub community discussion #26954). Yet another reason CI that triggers on prereleased silently misses releases; published + release.prerelease === true is the reliable predicate. GitHub Actions users: on: release with no types: filter runs for every action including edited and deleted — say types: [published].
GitHub never retries a failed delivery — one attempt, 10s timeout, then it's only in the Recent Deliveries log (redeliver by hand or via the API). If your release pipeline was down, the release event is not coming back on its own. Capture to a durable bin and relay to localhost while debugging. GitHub Apps need read-level Contents permission to subscribe to this event.
release.body markdown uses \r\n line endings (auto-generated notes) — a gotcha if you diff or hash release notes. assets[] may still be mid-upload when published fires for releases created via the API; state: "uploaded" is per-asset.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'user-agent: GitHub-Hookshot/8b5a4e2' \
  -H 'x-github-event: release' \
  -H 'x-github-delivery: a4c2f1e0-85b3-11f1-9d7a-3e5f8c2b6a90' \
  -H 'x-github-hook-id: 512403864' \
  -H 'x-github-hook-installation-target-type: repository' \
  -H 'x-hub-signature: sha1=cd5d4f0a168d5ea1a39615357f868af19fff2538' \
  -H 'x-hub-signature-256: sha256=d1733ad21168386b284fecd6a338125ad2a80505e359867e06ca1366b723ede9' \
 -d '{
  "action": "published",
  "release": {
    "url": "https://api.github.com/repos/octocat/hello-world/releases/236713545",
    "html_url": "https://github.com/octocat/hello-world/releases/tag/v2.4.0",
    "assets_url": "https://api.github.com/repos/octocat/hello-world/releases/236713545/assets",
    "upload_url": "https://uploads.github.com/repos/octocat/hello-world/releases/236713545/assets{?name,label}",
    "tarball_url": "https://api.github.com/repos/octocat/hello-world/tarball/v2.4.0",
    "zipball_url": "https://api.github.com/repos/octocat/hello-world/zipball/v2.4.0",
    "id": 236713545,
    "node_id": "RE_kwDOAWl9pM4OGxpJ",
    "tag_name": "v2.4.0",
    "target_commitish": "main",
    "name": "v2.4.0 — retry-safe webhook deliveries",
    "draft": false,
    "prerelease": false,
    "immutable": false,
    "created_at": "2026-08-30T08:55:12Z",
    "published_at": "2026-08-30T09:58:03Z",
    "author": {
      "login": "octocat",
      "id": 583231,
      "node_id": "MDQ6VXNlcjU4MzIzMQ==",
      "avatar_url": "https://avatars.githubusercontent.com/u/583231?v=4",
      "html_url": "https://github.com/octocat",
      "type": "User",
      "site_admin": false
    },
    "assets": [
      {
        "url": "https://api.github.com/repos/octocat/hello-world/releases/assets/198122437",
        "id": 198122437,
        "node_id": "RA_kwDOAWl9pM4LzucF",
        "name": "hello-world_2.4.0_linux_amd64.tar.gz",
        "label": "",
        "content_type": "application/gzip",
        "state": "uploaded",
        "size": 5824512,
        "download_count": 0,
        "created_at": "2026-08-30T09:57:40Z",
        "updated_at": "2026-08-30T09:57:44Z",
        "browser_download_url": "https://github.com/octocat/hello-world/releases/download/v2.4.0/hello-world_2.4.0_linux_amd64.tar.gz",
        "uploader": {
          "login": "octocat",
          "id": 583231,
          "type": "User"
        }
      }
    ],
    "tarball_name": null,
    "zipball_name": null,
    "body": "## What'\''s Changed\r\n* fix: retry webhook deliveries on 5xx by @octocat in #482\r\n\r\n**Full Changelog**: https://github.com/octocat/hello-world/compare/v2.3.1...v2.4.0"
  },
  "repository": {
    "id": 23675664,
    "node_id": "MDEwOlJlcG9zaXRvcnkyMzY3NTY2NA==",
    "name": "hello-world",
    "full_name": "octocat/hello-world",
    "private": false,
    "owner": {
      "login": "octocat",
      "id": 583231,
      "type": "User"
    },
    "html_url": "https://github.com/octocat/hello-world",
    "description": "Example service with webhook-driven releases",
    "fork": false,
    "default_branch": "main"
  },
  "sender": {
    "login": "octocat",
    "id": 583231,
    "type": "User",
    "site_admin": false
  }
}'

← All payload examples · Related guide · Signature debugger · Docs