Webhook Inspector

Server assisted API Testing

Open any capture endpoint and drill into each delivery — categorised headers, decoded JSON, detected provider (Stripe, GitHub, Shopify…), signature headers and cURL replay command.

Privacy: This tool sends the request through the Mutqan backend relay to reach the target. Only the target URL, headers and body you enter are transmitted, and nothing is stored.

How to use Webhook Inspector

  1. Create (or reuse) a capture URL and send a webhook to it.
  2. Select the delivery; the Headers tab opens by default.
  3. Check the Signature group and event details, then verify the signature in the Signature Analyzer.
  4. Copy the replay command to test your own handler.

Webhook Inspector features

  • Deep-dive view of each captured delivery: categorised headers (Signature, Provider, Content, Client, Network, Other)
  • Provider, event type, event id and signature scheme detection
  • Decoded JSON/form body with tree view, important fields and timestamp conversions
  • Raw HTTP message view and cURL replay with signature headers preserved
  • Shares the capture endpoint with the Webhook Tester

Webhook Inspector example

GitHub push delivery

Input:

X-GitHub-Event: push · X-Hub-Signature-256: sha256=… · X-GitHub-Delivery: 72d3…

Output:

Provider: GitHub (high confidence) · Event: push · Signature header: X-Hub-Signature-256 (GitHub scheme)
Signature: X-Hub-Signature-256 · Provider: X-GitHub-Event, X-GitHub-Delivery · Content: Content-Type, Content-Length

Frequently asked questions about Webhook Inspector

Which providers are recognised?

Stripe, GitHub, Shopify, Slack, Twilio, PayPal, GitLab, Bitbucket, SendGrid and Mailgun from their headers, user agents or payload shapes; everything else is treated as generic.

How are headers organised?

They are grouped into Signature, Provider, Content, Client, Network and Other, each explained in plain language.

Can I verify the signature here?

The inspector shows the signature header and scheme; copy the raw body and header into the Webhook Signature Analyzer together with your secret to verify it locally.

Why are some header values missing?

Hop-by-hop and proxy headers are dropped from the replay command; the captured detail view still lists every header the server received.