Reference

Webhooks

Webhook URLs, signing methods, supported events, and Slack trigger conditions for each provider.

Webhook URLs

Provider	URL
GitLab.com	https://api.mergeme.dev/webhooks/gitlab/{workspaceId}
GitLab Self-Hosted	https://api.mergeme.dev/webhooks/gitlab/{workspaceId}
GitHub.com	https://api.mergeme.dev/webhooks/github

Webhook authentication

Provider	Header	Format
GitLab (signing token)	`webhook-signature`	v1,<base64 HMAC-SHA256>
GitLab (secret token)	`X-Gitlab-Token`	Plain secret value
GitHub	`X-Hub-Signature-256`	sha256=<hex HMAC-SHA256>

GitLab signing tokens also include webhook-id and webhook-timestamp headers. MergeMe rejects requests with a timestamp older than 5 minutes to prevent replay attacks. GitLab self-hosted instances on version 18.x or earlier use the secret token path instead.

Supported events

Provider	Event	What triggers it
GitLab	`merge_request`	MR opened, closed, merged, review requested
GitLab	`note`	Comment on MR body or thread
GitHub	`pull_request`	PR opened, closed, merged, review requested
GitHub	`pull_request_review`	Review submitted (approved / changes requested / dismissed)
GitHub	`pull_request_review_comment`	Inline diff comment
GitHub	`issue_comment`	General PR comment (filtered to PRs only)

Slack message triggers

MergeMe posts or updates the Slack message when a PR/MR transitions to one of these states:

State	When it fires
`open`	PR/MR opened or reopened
`in_review`	Reviewer requested, or a review was dismissed
`approved`	All required reviewers approved
`changes_requested`	A reviewer requested changes
`merged`	PR/MR merged
`closed`	PR/MR closed without merging

Comments (MR notes or PR review comments) are posted as thread replies on the existing Slack message rather than creating a new top-level message.