---
title: "What a `web` hook receives"
description: "Headers: `X-Pando-Event` (the event), `X-Pando-Delivery` (the\ndelivery id), `X-Pando-Signature-256: sha256=<hex>` (HMAC-SHA256 of\nthe raw body with the hook's secret; GitHub's scheme under another\nname).\n\nDeliveries leave as soon as the change is recorded (no queue):\nat least once and not in order, like GitHub's. The body's `seq` is the event stream's sequence number:\ndrop a seq you have seen, and sort by it. A try that does not get a\n2xx within 10 seconds is retried after 10 s, 1 min, 5 min and 30 min\n(5 tries over about 36 minutes); then the delivery is dead until an\nowner redelivers it or replays the hook. Delivery records are kept for\nthe latest 1,000 per hook, with each one's last 10 tries.\n"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.gitpando.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Pando API

`POST hookDelivery`

_Webhook._

Headers: `X-Pando-Event` (the event), `X-Pando-Delivery` (the
delivery id), `X-Pando-Signature-256: sha256=<hex>` (HMAC-SHA256 of
the raw body with the hook's secret; GitHub's scheme under another
name).

Deliveries leave as soon as the change is recorded (no queue):
at least once and not in order, like GitHub's. The body's `seq` is the event stream's sequence number:
drop a seq you have seen, and sort by it. A try that does not get a
2xx within 10 seconds is retried after 10 s, 1 min, 5 min and 30 min
(5 tries over about 36 minutes); then the delivery is dead until an
owner redelivers it or replays the hook. Delivery records are kept for
the latest 1,000 per hook, with each one's last 10 tries.

## Authentication

Requires one of the following:

- `credential`, http, header `Authorization`
- `session`, apiKey, in cookie

## Request body

- `hookDelivery.event` (string, required) — `branch.opened`: the first push of a branch. `push`: any push through the door that moves or deletes a branch. `merged`: a Pando merge landed a branch; a buildkite hook builds main's merge commit (`merge_commit`) on main (`main_branch`). `tag`: a tag pushed, moved or deleted (or made by publishing a release): `tag` is its name, `head` its commit (zeros when deleted).
  - one of `"push"`, `"branch.opened"`, `"merged"`, `"tag"`
- `hookDelivery.delivery_id` (string, required)
- `hookDelivery.occurred_at` (string, required)
  - format `date-time`
- `hookDelivery.monorepo` (string, required) — `owner/name` when the delivery was made.
- `hookDelivery.monorepo_id` (string, required) — The monorepo's permanent id: a stable key across renames.
- `hookDelivery.repo` (string, required)
- `hookDelivery.ref` (string, required) — `refs/heads/<branch>`
- `hookDelivery.clone_url` (string, required) — The git door URL. Clone it with `read_token`.
- `hookDelivery.branch` (string, optional)
- `hookDelivery.head` (string, optional) — The new head; all zeros when the branch was deleted.
- `hookDelivery.before` (string, optional) — The old head; all zeros for a new branch.
- `hookDelivery.base` (string | null, optional) — The merge base with the default branch.
- `hookDelivery.title` (string | null, optional)
- `hookDelivery.description` (string | null, optional)
- `hookDelivery.author` (string | null, optional) — The branch's author (a user).
- `hookDelivery.pusher` (string | null, optional) — The user who pushed; for `merged`, who merged. Null only when Pando found a push in Artifacts' refs whose pusher it never learned (its record and its keep both failed).
- `hookDelivery.seq` (integer | null, optional) — The event stream's seq for this change: drop repeats, sort by it.
- `hookDelivery.merge_commit` (string, optional) — Only for `merged`.
- `hookDelivery.diff_url` (string, optional)
- `hookDelivery.read_token` (string, optional) — A read-only token for this one repo, valid 30 minutes, minted for this delivery. Use it as `Authorization: Bearer <read_token>` against `clone_url`.
- `hookDelivery.read_token_expires_at` (string, optional)
  - format `date-time`
- `hookDelivery.status_url` (string, optional) — `POST` a commit status here for `head`, with `status_token` or a member's credential.
- `hookDelivery.status_token` (string, optional) — Posts statuses for `head` in this repo for 24 hours, stamped with the hook's `app` (see createStatus). Absent when the Worker secret PANDO_STATUS_SECRET is not set or the branch was deleted.
- `hookDelivery.status_token_expires_at` (string, optional)
  - format `date-time`

## Example request

```json
{
  "event": "push",
  "delivery_id": "string",
  "occurred_at": "2019-08-24T14:15:22Z",
  "monorepo": "string",
  "monorepo_id": "string",
  "repo": "string",
  "branch": "string",
  "ref": "string",
  "head": "string",
  "before": "string",
  "base": "string",
  "title": "string",
  "description": "string",
  "author": "string",
  "pusher": "string",
  "seq": 0,
  "merge_commit": "string",
  "diff_url": "string",
  "clone_url": "string",
  "read_token": "string",
  "read_token_expires_at": "2019-08-24T14:15:22Z",
  "status_url": "string",
  "status_token": "string",
  "status_token_expires_at": "2019-08-24T14:15:22Z"
}
```

## Responses

### 200

Any 2xx counts as delivered.


Source: https://docs.gitpando.com/api/webhooks/hookDelivery/index.md