Skip to content
Pullminder Docs

API webhooks

Pullminder uses GitHub webhooks to receive pull request events in real time. When you install the Pullminder GitHub App, GitHub automatically configures the webhook. No manual setup is required.

Inbound: GitHub to Pullminder

Section titled “Inbound: GitHub to Pullminder”

Endpoint

Section titled “Endpoint”
POST /webhooks/github

This endpoint receives webhook payloads from GitHub. It is a public endpoint and does not require session authentication. Instead, every request is verified using the webhook signature.

Supported events

Section titled “Supported events”

Pullminder listens for pull request events with the following actions:

Event actionWhat happens
openedA new pull request is created. Pullminder fetches the diff and runs the full analysis pipeline.
synchronizeNew commits are pushed to an open pull request. Pullminder re-analyzes the updated diff.
reopenedA previously closed pull request is reopened. Pullminder runs analysis again with the current diff.

All other event types and actions are ignored.

Analysis pipeline

Section titled “Analysis pipeline”

When a supported event is received, Pullminder performs the following steps:

  1. Validate the signature — The X-Hub-Signature-256 header is verified against the webhook secret to confirm the payload was sent by GitHub.
  2. Fetch the diff — Pullminder retrieves the full pull request diff from the GitHub API using the installed app credentials. The diff is then analyzed by the configured rules, producing findings, a risk score, and any associated notifications.

Outbound: Pullminder to Slack

Section titled “Outbound: Pullminder to Slack”

If you have configured a Slack incoming webhook URL in your dashboard settings, Pullminder sends notifications to your Slack channel when certain events occur.

Alert format

Section titled “Alert format”

Slack messages are sent for the following events:

EventWhen it fires
High-risk PRA pull request exceeds the organization’s risk threshold
Policy blockA rule with the block action triggered, preventing merge

Each Slack message includes:

  • PR title and author
  • Repository name
  • Risk score
  • Number of findings by severity
  • Link to the PR detail page in the dashboard
  • Link to the pull request on GitHub

Testing the webhook

Section titled “Testing the webhook”

You can send a test message to your Slack channel from the dashboard settings page using the Test webhook button. This sends a sample alert payload so you can verify the channel and formatting before relying on it for real notifications.

Next steps

Section titled “Next steps”