SMS Delivery Inspector

Server assisted New API Testing

Point the inbound-SMS webhook of your own number at a capture URL, send yourself a message, and inspect the delivery your provider actually made: the parsed body, the headers (credential headers shown as [redacted]), the signature scheme in use and a replayable curl command. Built for debugging your own integration when a message arrives at the carrier but never reaches your handler.

Privacy: Captured requests are held on the Mutqan backend for two hours and then deleted, even though the capture URL itself stays usable for 24 hours. No mailbox or address is created for you. Credentials such as Authorization headers are never stored. Do not point production traffic containing personal data at it.

What is a webhook?

A webhook is an HTTP request a service sends to a URL you register when something happens — a payment settles, a message is delivered, a build finishes — so your system reacts to events instead of polling. Testing one means capturing what is actually sent (method, headers, body), checking retries and ordering, and verifying the signature that proves the call came from the sender.

Security note: A webhook endpoint is a public URL anyone can post to. Verify the sender's signature (usually an HMAC over the raw body) with a constant-time comparison, reject stale timestamps, and treat the payload as untrusted input.

Read the guide: What is API Testing? How to Test a REST API

How to use SMS Delivery Inspector

  1. Press Create capture URL and copy the address it gives you.
  2. In your provider console, set that URL as the inbound-message webhook for a number you own.
  3. Send a text message to your own number.
  4. The delivery appears here — open it to inspect the body, headers and signature.
  5. Compare it with what your own handler received to find where the two diverge.
Your text goes to your own number at your provider; only the provider’s HTTP callback reaches the capture URL, which is what this page shows you.
  • You a number you own
  • Your SMS provider e.g. Twilio
  • Capture service capture URL
  • This page
  1. 1 From This page To Capture service: Create capture URL
  2. 2 From Capture service To This page: The capture URL to copy reply https://www.mutqansoft.sa/hooks/AbC123xYz
  3. 3 From You To Your SMS provider: Set it as your number’s inbound-message webhook On Twilio: “A message comes in”
  4. 4 From You To Your SMS provider: Text your own number
  5. 5 From Your SMS provider To Capture service: POSTs the inbound message Form-encoded, not JSON, with X-Twilio-Signature From=%2B966500000000&Body=test&MessageSid=SM…
  6. 6 From This page To Capture service: Checks for new deliveries
  7. 7 From Capture service To This page: The delivery appears here reply Body, headers and signature, to compare with what your handler received

Outcome: No number is allocated and no message is received on your behalf.

Each captured delivery is deleted two hours after it arrives; the capture URL stays usable for 24 hours.

SMS Delivery Inspector features

  • Capture URL you can paste straight into your provider's inbound-message webhook field
  • Full request view: parsed body, headers (credential headers shown as [redacted]; signature headers kept), query string, method and exact byte size
  • Form-encoded and JSON payloads both parsed, so Twilio-style and JSON-style providers both read clearly
  • Signature headers surfaced and the scheme identified, so you can see what your code should verify
  • Replayable curl command for the exact delivery, to re-run it against your own endpoint
  • No number is allocated and no message is received on your behalf — it inspects your own provider's callback

SMS Delivery Inspector example

Finding out why an inbound SMS never reached the handler

Input:

Provider webhook → https://www.mutqansoft.sa/hooks/AbC123xYz
Send an SMS to your own number

Output:

POST /  application/x-www-form-urlencoded  412 bytes
X-Twilio-Signature: q1VZ...
Body: From=%2B966500000000&Body=test&MessageSid=SM...
→ form-encoded, not JSON — a handler expecting JSON would parse this as empty

Frequently asked questions about SMS Delivery Inspector

Does this give me a phone number?

No, and deliberately so. It inspects the webhook your own provider sends for a number you already control. It never allocates a number and never receives a message on anyone else's behalf.

How do I point my provider at it?

Create a capture URL here, then paste it into the inbound-message webhook field for your number in your provider console — "A message comes in" on Twilio, the inbound SMS callback on Vonage, and the equivalent elsewhere. Send yourself a text and the delivery appears here.

Which providers does it understand?

The payload and headers are shown for any sender. Signature schemes are recognised for the common providers, including Twilio, and the raw header is always displayed so you can verify by hand when it is not.

Why did my message never arrive at my own endpoint?

The usual causes are visible here: a non-2xx response from your handler, a signature your code rejects, a form-encoded body parsed as JSON, or a URL the provider cannot reach. Compare what arrives at the capture URL with what your handler received.

How long are captured requests kept?

Two hours. The capture URL itself stays usable for 24 hours so the webhook you configured at your provider keeps working, but each delivery it captures — which for an inbound SMS contains a phone number and often a verification code — is deleted two hours after it arrives. Do not send production traffic containing personal data through it.

Technical notes

This tool deliberately has no provider integration. It allocates no phone number, holds no provider credential and never receives a message for anyone: it captures the HTTP callback your own provider makes for a number you already control. That keeps it a debugging tool for your integration rather than a way to receive messages anonymously.

A captured request is deleted two hours after it arrives, and a bounded number are kept per URL. The URL outlives them — it stays usable for 24 hours so the webhook you configured at your provider keeps working — but the payloads do not, because an inbound SMS body carries a phone number and often a live verification code. Because anything sent to a capture URL is readable by whoever holds it, production traffic carrying personal data should not be pointed at one.

References