Delete a webhook from unwanted repository

Hello,

TL;DR: I’d like to delete a webhook that’s contacting my server without having permissions on the webhook’s repository to delete it. Is there a way?

Long version:

I work on a platform where users can develop using Github repositories and we run builds with their code. There’s an OAuth app that adds a webhook when they sign up and when they delete their account, we remove the webhook.

We’d like to start garbage collecting unused accounts and remove the associated webhooks. As the user won’t be logged in, we can’t make the API request in his name.

I looked around in the API’s documentation but wasn’t able to find a way. Did I miss something?

If I haven’t, maybe you could add a response that the remote server could give to a webhook in order to have it deleted? This way it could avoid getting spammed by unwanted webhooks, and your servers don’t have to needlessly send them.

Thank you for your time,
Denis

1 Like

Hi @icallhimtest,

Thanks for being here! Would  listing webhooks on the repository and then use the Delete a hook API endpoint to remove any unwanted webhooks from the repository work?

Please do not hesitate to reach out with any further questions.

1 Like

Hello @andreagriffiths11,

Thank you for your reply.

Those pages indeed helped us a lot when we had to set up and delete the hooks when we are authenticated with the user. However they don’t explain how we can delete a webhook if you no longer have access to that user’s authentification token.

When a webhook’s end-point is targeted to a server, I think it’s reasonable to allow the server to remove it without requiring the user’s/repository’s consent.

Kind Regards,

2 Likes

Hi @andreagriffiths11, We’re facing a similar issue: if a user uninstalls our Github App (in https://github.com/settings/apps) then we would like to remove the webhook from it that calls our server. However, when we receive the installation delete event we no longer have access to the user’s repository (or so my colleague tells me) so we won’t be able to uninstall the webhook. Is there a way to do this?

Thanks in advance,
Maarten

Thanks for the ping @mnieber and welcome to the community, GitHub webhooks don’t offer such a feature currently, but it’s something the engineering team working on webhooks is already aware of and tracking as something they want to do.

I’ve taken a look and there is internal discussing allowing update/delete operations on webhooks per your use case. As of now, nothing has been implemented but I’ll be sure to followup with you as soon as there’s any news here.