Vercel deployment.succeeded webhook payload example

Vercel · event: deployment.succeeded · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into Vercel's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
x-vercel-signature: 9317140cc8fab236d11fd5974cee9f8f49fb6aba

Body

{
  "type": "deployment.succeeded",
  "id": "evt_9NqXk2mVYbTLW5d8pFgahRz3",
  "createdAt": 1787990400000,
  "region": null,
  "payload": {
    "team": {
      "id": "team_LLxpyhYVg3rDG29cbSqhZM0d"
    },
    "user": {
      "id": "sVMwbnvfxfCzMcHnq3nJHZ9x"
    },
    "deployment": {
      "id": "dpl_6CR1uw9hBOWdbUZFHfSC8mvC7fBJ",
      "meta": {
        "githubCommitRef": "main",
        "githubCommitSha": "59b20b8d5c6ff8d09518454d4dd8b7b30f095ab5",
        "githubCommitMessage": "fix: handle empty webhook payloads"
      },
      "url": "my-app-4x8z1q2kf.vercel.app",
      "name": "my-app"
    },
    "links": {
      "deployment": "https://vercel.com/acme/my-app/6CR1uw9hBOWdbUZFHfSC8mvC7fBJ",
      "project": "https://vercel.com/acme/my-app"
    },
    "target": "production",
    "project": {
      "id": "prj_kD4kSqBQmPxLW8cVJnrahXTG2y1z"
    },
    "plan": "pro",
    "regions": [
      "iad1"
    ]
  }
}

Things that bite people

x-vercel-signature is a hex HMAC-SHA1 of the raw body — not SHA-256. Verifiers that assume SHA-256 (most copy-pasted snippets) fail on every delivery. This example's signature actually verifies: HMAC-SHA1 the body above with key vercel_wh_secret_JJ1r8dKxQ2sample and compare hex digests.
Which secret depends on the webhook kind: account webhooks use the secret shown once in the "Webhook Created" dialog (lose it and you recreate the webhook); integration webhooks sign with your Integration/Client Secret from the Integration Console instead.
Every event shares the same envelope — type, id, createdAt (epoch milliseconds), region (possibly null), and an event-specific payload. Switch on json.type, not on anything inside payload.
deployment.succeeded fires after blocking checks pass; there are also separate deployment.ready and deployment.promoted events — production-traffic automation usually wants promoted, which excludes rollbacks.
Account-level webhook config needs a Pro/Enterprise team (max 20 webhooks/team); payload.deployment.meta is a loose map whose keys vary by git provider — don't hard-require githubCommitSha.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'x-vercel-signature: 9317140cc8fab236d11fd5974cee9f8f49fb6aba' \
 -d '{
  "type": "deployment.succeeded",
  "id": "evt_9NqXk2mVYbTLW5d8pFgahRz3",
  "createdAt": 1787990400000,
  "region": null,
  "payload": {
    "team": {
      "id": "team_LLxpyhYVg3rDG29cbSqhZM0d"
    },
    "user": {
      "id": "sVMwbnvfxfCzMcHnq3nJHZ9x"
    },
    "deployment": {
      "id": "dpl_6CR1uw9hBOWdbUZFHfSC8mvC7fBJ",
      "meta": {
        "githubCommitRef": "main",
        "githubCommitSha": "59b20b8d5c6ff8d09518454d4dd8b7b30f095ab5",
        "githubCommitMessage": "fix: handle empty webhook payloads"
      },
      "url": "my-app-4x8z1q2kf.vercel.app",
      "name": "my-app"
    },
    "links": {
      "deployment": "https://vercel.com/acme/my-app/6CR1uw9hBOWdbUZFHfSC8mvC7fBJ",
      "project": "https://vercel.com/acme/my-app"
    },
    "target": "production",
    "project": {
      "id": "prj_kD4kSqBQmPxLW8cVJnrahXTG2y1z"
    },
    "plan": "pro",
    "regions": [
      "iad1"
    ]
  }
}'

← All payload examples · Signature debugger · Docs