Configure provider webhooks

Provider webhooks trigger pull-request reviews and supported push scans. Connect the SCM identity from Integrations, configure review behavior under Reviews → Settings, and configure push-scan policy under Settings → General.

Delivery URLs

Provider	HTTPS delivery URL	Implemented events
GitHub	`https://codestax.co/api/webhooks/github`	`pull_request` opened, synchronize, reopened; `push`
GitLab.com	`https://codestax.co/api/webhooks/gitlab`	Merge Request Hook open, update, reopen
Bitbucket Cloud	`https://codestax.co/api/webhooks/bitbucket`	`pullrequest:created`, `pullrequest:updated`, `repo:push`

GitHub App and Bitbucket Connect installations can provision their own provider integration paths. For a manually installed webhook, obtain the matching webhook secret from your CodeStax administrator; the customer dashboard does not reveal the shared provider webhook secret.

Configure GitHub

Open the GitHub repository’s Settings → Webhooks → Add webhook page.
Set the payload URL to https://codestax.co/api/webhooks/github.
Select JSON content, enter the configured secret, and subscribe to Pull requests. Add Pushes when you use auto-scan on push.
Send a test delivery and confirm a 2xx response.

GitHub requests are verified with the X-Hub-Signature-256 HMAC SHA-256 signature.

Configure GitLab.com

Open the GitLab.com project’s Settings → Webhooks page.
Set the URL to https://codestax.co/api/webhooks/gitlab.
Enter the configured secret token and enable Merge request events.
Send a test merge-request event.

CodeStax verifies the X-Gitlab-Token using a constant-time comparison. GitLab push events are not handled by this route.

Configure Bitbucket Cloud

Open the Bitbucket repository’s Repository settings → Webhooks → Add webhook page.
Set the URL to https://codestax.co/api/webhooks/bitbucket.
Select Pull request created and Pull request updated. Add Repository push when you use auto-scan on push.
Save and send a test event.

CodeStax verifies the Bitbucket X-Hub-Signature HMAC SHA-256 signature. Bitbucket Data Center and Server are not supported by this route.

Control review dispatch

Open Reviews → Settings to configure the organization master switch, open/update/reopen event switches, target-branch patterns, exclusions, and repository overrides. CodeStax evaluates this policy before reserving review quota or dispatching work.

Webhook delivery order is not treated as pull-request chronology. For an eligible event, CodeStax resolves the provider’s current head and base revisions and reuses a matching review generation where appropriate.

Control push scans

Open Settings → General and change Auto-scan on push. GitHub and Bitbucket push handlers match the connected repository, check the effective policy and tracked branch, deduplicate redeliveries, and then queue a scan. See Auto-scan on push.

Troubleshoot a delivery

Symptom	Check
`401 Unauthorized`	The signature or secret-token header does not match the configured provider secret
Event accepted but no review	The repository is not connected, the event switch is off, the target branch is excluded, or review quota is exhausted
Event accepted but no scan	Auto-scan is off, the push is not for the tracked branch, or scan quota is exhausted
Duplicate provider delivery	CodeStax records a stable delivery identity and returns an already-processed result instead of dispatching twice
Review shows failed dispatch	Retry from the review detail page after the scanner service recovers

Use the provider’s delivery log to inspect the response status. Organization audit logs contain customer-visible actions; provider delivery and retry state is also visible on the review detail page.