Request Body Inspector

Server assisted API Testing

Send POST/PUT requests to a capture URL and see the raw body, detected content type, parsed JSON/form fields and byte size — great for verifying what your app really transmits.

Privacy: Captured requests are held on the Mutqan backend for two hours and then deleted. The capture URL itself expires at most 24 hours after it is created; the SMS Delivery Inspector deletes its URL when you leave, reload or close the page, as the other capture tools do when the browser blocks session storage. No mailbox or address is created for you. Credentials such as Authorization headers are never stored. Do not point production traffic containing personal data at it.

What is a webhook?

A webhook is an HTTP request a service sends to a URL you register when something happens — a payment settles, a message is delivered, a build finishes — so your system reacts to events instead of polling. Testing one means capturing what is actually sent (method, headers, body), checking retries and ordering, and verifying the signature that proves the call came from the sender.

Security note: A webhook endpoint is a public URL anyone can post to. Verify the sender's signature (usually an HMAC over the raw body) with a constant-time comparison, reject stale timestamps, and treat the payload as untrusted input.

Read the guide: What is API Testing? How to Test a REST API

How to use Request Body Inspector

  1. Create a capture URL.
  2. Send the request from your application or with cURL.
  3. Select it — the Body tab shows the parsed and raw body side by side.

Request Body Inspector features

  • Captures POST/PUT/PATCH bodies exactly as sent: raw bytes, size and Content-Type
  • JSON pretty-printed and as a tree; form-urlencoded decoded to fields; XML shown as text
  • Body tab opens by default; truncation is flagged
  • Important fields and timestamps extracted from JSON bodies
  • Copy payload or cURL reproduction

Request Body Inspector example

Form submission

Input:

POST … Content-Type: application/x-www-form-urlencoded
name=Layla&plan=pro&agree=on

Output:

Form fields
{
  "name": "Layla",
  "plan": "pro",
  "agree": "on"
}
32 B · application/x-www-form-urlencoded

Frequently asked questions about Request Body Inspector

Which body types are decoded?

JSON is pretty-printed and shown as a tree, application/x-www-form-urlencoded is decoded into fields, XML is shown as text; everything is also available raw.

How large can the body be?

The capture keeps the first 256 KB of each body and marks anything longer as truncated. Requests with a body over 4 MB are refused with 413 Content Too Large and are not captured.

Can I verify what my app really sends?

Yes — that is the point: compare the raw bytes, Content-Type and size with what your code intended to send.

References