HTTP Request Inspector

Server assisted API Testing

Point any HTTP client, browser or mobile app at your inspector URL to see the raw request as the server receives it — perfect for debugging SDKs, proxies and mobile apps.

Privacy: Captured requests are held on the Mutqan backend for two hours and then deleted. The capture URL itself expires at most 24 hours after it is created; the SMS Delivery Inspector deletes its URL when you leave, reload or close the page, as the other capture tools do when the browser blocks session storage. No mailbox or address is created for you. Credentials such as Authorization headers are never stored. Do not point production traffic containing personal data at it.

What is a webhook?

A webhook is an HTTP request a service sends to a URL you register when something happens — a payment settles, a message is delivered, a build finishes — so your system reacts to events instead of polling. Testing one means capturing what is actually sent (method, headers, body), checking retries and ordering, and verifying the signature that proves the call came from the sender.

Security note: A webhook endpoint is a public URL anyone can post to. Verify the sender's signature (usually an HMAC over the raw body) with a constant-time comparison, reject stale timestamps, and treat the payload as untrusted input.

Read the guide: What is API Testing? How to Test a REST API

How to use HTTP Request Inspector

  1. Create a capture URL.
  2. Send a request from the client you are debugging (or open the URL in a browser tab).
  3. Select the request; the raw view shows the full message, other tabs break it down.
  4. Compare with what your code intended to send.

HTTP Request Inspector features

  • See requests as the server received them: method, path, query, headers (credential values shown as [redacted]; Cookie and cf-* not recorded), body, client IP
  • Raw HTTP message view opens by default; JSON and form bodies decoded on demand
  • Works with any client — mobile SDKs, scripts, proxies, browsers, IoT devices
  • Open the URL in a new tab to see what your browser sends
  • Copy headers, payload or a cURL reproduction

HTTP Request Inspector example

Mobile SDK request

Input:

App → PUT https://www.mutqansoft.sa/hooks/3f9c…/v1/devices/42?locale=ar

Output:

PUT /v1/devices/42?locale=ar HTTP/1.1
user-agent: MyApp/3.2.1 (Android 14)
content-type: application/json
x-app-token: [redacted]

{"pushToken":"…","timezone":"Asia/Riyadh"}

Frequently asked questions about HTTP Request Inspector

What is this for?

Point any HTTP client (mobile SDK, script, proxy, IoT device) at the URL and see what arrives at the server: method, path, query, headers (credential values shown as [redacted]; Cookie and cf-* are not recorded), body, IP — the raw HTTP view shows it as one message.

Can I open the URL in a browser?

Yes, "Open in new tab" performs a GET from your browser so you can see what a browser sends by default.

Is anything stored permanently?

Captured requests live only until the endpoint expires (24 h) or you delete it, and are never shared with anyone else.

Which HTTP methods and body sizes does the capture URL accept?

Any method — GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS — on the URL or any sub-path, with CORS enabled so browser fetch() works. Bodies are kept up to 256 KB (larger ones are truncated and flagged), each endpoint retains its latest 200 requests at up to 60 per minute, and every call receives a 200 JSON acknowledgement.

References