Webhooks

Automatically analyze PRs when they're opened or updated

Overview

Webhooks allow Axiomo to automatically analyze pull requests when they're opened, updated, or marked ready for review. Instead of manually pasting PR URLs, configure a webhook once and Axiomo will analyze PRs as they come in.

How It Works

Enable webhook via API

Call the enable endpoint to generate a webhook secret for your repository.

Add webhook to GitHub

Configure the webhook in your GitHub repository settings using the provided URL and secret.

Automatic analysis

When a PR is opened or updated, GitHub sends an event and Axiomo runs analysis automatically.

Enabling Webhooks

Use the API to enable webhooks for a repository:

Enable Webhook

curl -X POST https://axiomo.app/api/repos/github/owner/repo/webhook/enable \
  -H "Cookie: axiomo_session=YOUR_SESSION"

Response

{
  "status": "enabled",
  "webhook_url": "https://axiomo.app/api/webhooks/github",
  "webhook_secret": "abc123...",
  "content_type": "application/json",
  "events": ["pull_request"],
  "instructions": "..."
}

GitHub Setup

After enabling the webhook via API, configure it in GitHub:

1. Navigate to Webhooks

Go to your repository on GitHub, then Settings → Webhooks → Add webhook

2. Configure Webhook

Payload URL https://axiomo.app/api/webhooks/github

Content type application/json

Secret Use the secret from the API response

Events Select "Pull requests" only

3. Save

Click "Add webhook". GitHub will send a ping event to verify the connection.

Supported Events

Axiomo processes these pull request actions:

Action	Triggers Analysis
`opened`	Yes - new PR created
`synchronize`	Yes - new commits pushed
`ready_for_review`	Yes - draft PR marked ready
`reopened`	Yes - closed PR reopened

Draft PRs

Draft PRs are not analyzed until they're marked as ready for review.

Security

Webhook requests are verified using HMAC-SHA256 signatures. GitHub signs each webhook payload with your secret, and Axiomo verifies this signature before processing.

Secrets are generated using cryptographically secure random bytes
Each repository has its own unique secret
Invalid signatures are rejected with 401 Unauthorized
Secrets are never exposed in API responses (except on initial enable)

Disabling Webhooks

To disable webhooks for a repository:

Disable Webhook

curl -X DELETE https://axiomo.app/api/repos/github/owner/repo/webhook \
  -H "Cookie: axiomo_session=YOUR_SESSION"

Don't forget GitHub

After disabling in Axiomo, also remove the webhook from your GitHub repository settings to stop GitHub from sending events.