HTTP response handling

HTTP hooks use HTTP status codes and response bodies instead of exit codes and stdout. The outcomes below apply to most events; an event with its own failure contract in the per-event table, such as WorktreeCreate, applies that contract to a failed HTTP hook too:

• 2xx with an empty body: success, equivalent to exit code 0 with no output
• 2xx with a JSON object body: parsed using the same JSON output schema as command hooks. A body that fails schema validation is a non-blocking error
• 2xx with any other body, such as plain text: non-blocking error, handled the same as a non-2xx status. Claude Code doesn't add the text to Claude's context
• Non-2xx status: non-blocking error, execution continues
• Connection failure: non-blocking error, execution continues
• Timeout: the hook is canceled, as described under Timeouts

Unlike command hooks, HTTP hooks can't signal a blocking error through status codes alone. To block a tool call or deny a permission, return a 2xx response with a JSON body containing the appropriate decision fields.