ZenSailor LogoZenSailor

Webhooks and CI/CD

Trigger deployments from pipelines and external tools.

Every service has a redeploy webhook with its own token — the closest thing to git push to deploy outside of GitHub. Because the token is service-scoped, a webhook can only redeploy that service, which keeps CI credentials least-privilege.

Trigger a redeploy#

The webhook URL and token live under the service's Webhook settings. Call it from any pipeline — no headers required:

BASH
curl -X POST https://paas.example.com/api/hooks/redeploy \
  -H "Authorization: Bearer <service-webhook-token>" \
  -H "Content-Type: application/json" \
  -d '{"serviceId": "<service-id>"}'

Regenerate the token from the dashboard or CLI when it leaks — old tokens stop working immediately:

BASH
zensailor service webhook get <service-id>
zensailor service webhook regenerate <service-id>

GitHub push events#

With the GitHub App connected, pushes to a service's configured branch deploy automatically; only that branch triggers the build. Deploy windows apply to webhook-triggered deployments like every other trigger — queued, not rejected, when the window is closed.

In CI/CD: if you deploy from GitHub Actions, GitLab CI or a scheduler, the webhook token is all you need — it stays out of every pipeline's credential store except your own.