Push Webhooks

When a push updates one or more branches or tags, Corigin asynchronously sends one signed HTTP POST containing every updated ref to the repository's configured public HTTPS endpoint.

Configure a webhook

Configure the webhook

corigin repos webhook set REPO_ID WEBHOOK_URL

2
Save the signing secret
The command prints the signing secret. It is shown only once.

Webhook request

{
  "id": "EVENT_ID",
  "type": "push",
  "createdAt": "2026-08-11T18:42:00Z",
  "repoId": "REPO_ID",
  "refs": [
    {
      "name": "refs/heads/main",
      "before": "BEFORE_COMMIT_OID",
      "after": "AFTER_COMMIT_OID",
      "force": false
    }
  ]
}

Header	Value
`Content-Type`	`application/json`
`Corigin-Event-Id`	The payload `id`
`Corigin-Event-Type`	`push`
`Corigin-Webhook-Timestamp`	Unix timestamp in seconds
`Corigin-Webhook-Signature`	`v1=<hex digest>`

Verify the signature

Compute the hexadecimal HMAC-SHA256 digest of the decimal timestamp, a period, and the exact raw request body using the signing secret. The expected header is v1= followed by that digest.