Webhook Inspector

Server assisted API Testing

Open any capture endpoint and drill into each delivery — categorised headers, decoded JSON, detected provider (Stripe, GitHub, Shopify…), signature headers and cURL replay command.

Privacy: Captured requests are held on the Mutqan backend for two hours and then deleted. The capture URL itself expires at most 24 hours after it is created; the SMS Delivery Inspector deletes its URL when you leave, reload or close the page, as the other capture tools do when the browser blocks session storage. No mailbox or address is created for you. Credentials such as Authorization headers are never stored. Do not point production traffic containing personal data at it.

What is a webhook?

A webhook is an HTTP request a service sends to a URL you register when something happens — a payment settles, a message is delivered, a build finishes — so your system reacts to events instead of polling. Testing one means capturing what is actually sent (method, headers, body), checking retries and ordering, and verifying the signature that proves the call came from the sender.

Security note: A webhook endpoint is a public URL anyone can post to. Verify the sender's signature (usually an HMAC over the raw body) with a constant-time comparison, reject stale timestamps, and treat the payload as untrusted input.

Read the guide: What is API Testing? How to Test a REST API

How to use Webhook Inspector

  1. Create (or reuse) a capture URL and send a webhook to it.
  2. Select the delivery; the Headers tab opens by default.
  3. Check the Signature group and event details, then verify the signature in the Signature Analyzer.
  4. Copy the replay command to test your own handler.

Webhook Inspector features

  • Deep-dive view of each captured delivery: categorised headers (Signature, Provider, Content, Client, Network, Other)
  • Provider, event type, event id and signature scheme detection
  • Decoded JSON/form body with tree view, important fields and timestamp conversions
  • Raw HTTP message view and cURL replay with signature headers preserved
  • Shares the capture endpoint with the Webhook Tester

Webhook Inspector example

GitHub push delivery

Input:

X-GitHub-Event: push · X-Hub-Signature-256: sha256=… · X-GitHub-Delivery: 72d3…

Output:

Provider: GitHub (high confidence) · Event: push · Signature header: X-Hub-Signature-256 (GitHub scheme)
Signature: X-Hub-Signature-256 · Provider: X-GitHub-Event, X-GitHub-Delivery · Content: Content-Type, Content-Length

Frequently asked questions about Webhook Inspector

Which providers are recognised?

Stripe, GitHub, Shopify, Slack, Twilio, PayPal, GitLab, Bitbucket, SendGrid and Mailgun from their headers, user agents or payload shapes; everything else is treated as generic.

How are headers organised?

They are grouped into Signature, Provider, Content, Client, Network and Other, each explained in plain language.

Can I verify the signature here?

The inspector shows the signature header and scheme; copy the raw body and header into the Webhook Signature Analyzer together with your secret to verify it locally.

Why are some header values missing?

Cookie, Set-Cookie and all cf-* headers are never recorded. Authorization, API-key and other credential-like headers (names containing token, secret, password or api-key) are listed with the value [redacted], so the credential itself is never stored; signature headers are kept. The replay command also leaves out hop-by-hop headers such as Host and Content-Length.

References