Forward targets

JSON schema

The value must be a JSON array ([ ... ]). Each element is one forward target. Property names are case-sensitive except for type, which may also be spelled destinationType.

The legacy Target URL field on the edit page is kept in sync with the first HTTP target for API compatibility.

HTTP

Standard webhook POST to your URL. No cloud credentials.

Required: url

{
  "name": "Primary",
  "type": "http",
  "url": "https://api.example.com/webhooks",
  "enabled": true,
  "conditions": null
}

Amazon S3

Writes a JSON document per capture. Requires AWS credentials on the target.

Required: bucket

Optional: prefix, region, endpoint (custom S3-compatible endpoint)

{
  "name": "Archive bucket",
  "type": "s3",
  "bucket": "my-captures",
  "prefix": "webhooks",
  "region": "us-east-1",
  "awsAccessKeyId": "AKIA...",
  "awsSecretAccessKey": "your-secret-key",
  "enabled": true,
  "conditions": null
}

Amazon SQS

Publishes one JSON message per capture to your queue. Requires AWS credentials on the target.

Required: queueUrl (alias: url)

Optional: region

{
  "name": "Events queue",
  "type": "sqs",
  "queueUrl": "https://sqs.us-east-1.amazonaws.com/123456789012/webhook-events",
  "region": "us-east-1",
  "awsAccessKeyId": "AKIA...",
  "awsSecretAccessKey": "your-secret-key",
  "enabled": true,
  "conditions": null
}

Apache Kafka

Produces one message per capture. Message key is the capture request id. No cloud credentials are required today (plain broker connection).

Required: topic, bootstrap (alias: bootstrapServers)

{
  "name": "Kafka stream",
  "type": "kafka",
  "topic": "webhook.captures",
  "bootstrap": "kafka.example.com:9092",
  "enabled": true,
  "conditions": null
}

Google Pub/Sub

Publishes one message per capture. Requires a GCP service account on the target — see Credentials.

Required: project, topic

{
  "name": "Pub/Sub topic",
  "type": "pubsub",
  "project": "my-gcp-project",
  "topic": "webhook-captures",
  "gcpCredentialsJson": "{ \"type\": \"service_account\", ... }",
  "enabled": true,
  "conditions": null
}

Alias: gcpServiceAccountJson is accepted instead of gcpCredentialsJson.

Credentials

Cloud destination credentials are stored in the forward-target JSON on the edit page. They are encrypted at rest before being saved.

• First save: include the full credentials in the JSON array.
• Later edits: secrets are not shown in the textarea. You'll see "credentialsSet": true when loading an existing target. Leave awsSecretAccessKey blank (or omit credential fields) to keep the stored secret.
• Matching: include the target id from a previous save, or keep the same name + type, so credentials merge correctly.

Conditional routing

Each target may include an optional conditions object. When set, the target receives a capture only if all specified rules match. Omit a field to skip that check.

{
  "method": "POST",
  "headerName": "X-GitHub-Event",
  "headerValue": "push",
  "bodyContains": "checkout.session"
}

Forwarded payload

S3, SQS, Kafka, and Pub/Sub destinations receive the same JSON document as HTTP forwards (capture metadata plus body). HTTP forwards use your configured signing scheme and header filters; see signature verification.

Matching forwards are delivered asynchronously with automatic retries. Use Pause forwards on the endpoint page to stop delivery without disabling capture.