POST
/repos/{owner}/{repo}/git/commitsCreate a commit
Creates a new Git commit object.
Signature verification object
The response will include a verification object that describes the result of verifying the commit's signature. The following fields are included in the verification object:
| Name | Type | Description |
|---|---|---|
verified | boolean | Indicates whether GitHub considers the signature in this commit to be verified. |
reason | string | The reason for verified value. Possible values and their meanings are enumerated in the table below. |
signature | string | The signature that was extracted from the commit. |
payload | string | The value that was signed. |
verified_at | string | The date the signature was verified by GitHub. |
These are the possible values for reason in the verification object:
| Value | Description |
|---|---|
expired_key | The key that made the signature is expired. |
not_signing_key | The "signing" flag is not among the usage flags in the GPG key that made the signature. |
gpgverify_error | There was an error communicating with the signature verification service. |
gpgverify_unavailable | The signature verification service is currently unavailable. |
unsigned | The object does not include a signature. |
unknown_signature_type | A non-PGP signature was found in the commit. |
no_user | No user was associated with the committer email address in the commit. |
unverified_email | The committer email address in the commit was associated with a user, but the email address is not verified on their account. |
bad_email | The committer email address in the commit is not included in the identities of the PGP key that made the signature. |
unknown_key | The key that made the signature has not been registered with any user's account. |
malformed_signature | There was an error parsing the signature. |
invalid | The signature could not be cryptographically verified using the key whose key-id was found in the signature. |
valid | None of the above errors applied, so the signature is considered to be verified. |
- RetriesRetries up to 2×, 500ms backoff, 30s timeout.
ownerstringrequired
The account owner of the repository. The name is not case sensitive.
repostringrequired
The name of the repository without the `.git` extension. The name is not case sensitive.
messagestringrequired
The commit message
treestringrequired
The SHA of the tree object this commit points to
parentsarray<string>optional
The full SHAs of the commits that were the parents of this commit. If omitted or empty, the commit will be written as a root commit. For a single parent, an array of one SHA should be provided; for a merge commit, an array of more than one should be provided.
authorobjectoptional
Information about the author of the commit. By default, the `author` will be the authenticated user and the current date. See the `author` and `committer` object below for details.
committerobjectoptional
Information about the person who is making the commit. By default, `committer` will use the information set in `author`. See the `author` and `committer` object below for details.
signaturestringoptional
The [PGP signature](https://en.wikipedia.org/wiki/Pretty_Good_Privacy) of the commit. GitHub adds the signature to the `gpgsig` header of the created commit. For a commit signature to be verifiable by Git or GitHub, it must be an ASCII-armored detached PGP signature over the string commit as it would be written to the object database. To pass a `signature` parameter, you need to first manually create a valid PGP signature, which can be complicated. You may find it easier to [use the command line](https://git-scm.com/book/id/v2/Git-Tools-Signing-Your-Work) to create signed commits.
201Response
shastringrequired
SHA for the commit
node_idstringrequired
urlstringrequired
authorobjectrequired
Identifying information for the git-user
committerobjectrequired
Identifying information for the git-user
messagestringrequired
Message describing the purpose of the commit
treeobjectrequired
parentsarray<object>required
verificationobjectrequired
html_urlstringrequired
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
409Conflict
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Validation failed, or the endpoint has been spammed.
messagestringrequired
documentation_urlstringrequired
errorsarray<object>optional
Error handling
A 404 is returned: Resource not found. A 409 is returned: Conflict. A 422 is returned: Validation failed, or the endpoint has been spammed.