What is a webhook?
A webhook is an HTTP request a service sends to a URL you register when something happens — a payment settles, a message is delivered, a build finishes — so your system reacts to events instead of polling. Testing one means capturing what is actually sent (method, headers, body), checking retries and ordering, and verifying the signature that proves the call came from the sender.
Security note: A webhook endpoint is a public URL anyone can post to. Verify the sender's signature (usually an HMAC over the raw body) with a constant-time comparison, reject stale timestamps, and treat the payload as untrusted input.
Read the guide: What is API Testing? How to Test a REST API
How to use Webhook Payload Formatter
- Paste the webhook body (and, if you have them, the request headers).
- The payload is formatted immediately; read the overview and the important-field table.
- Use the timestamp table to sanity-check event times and the tree to navigate large payloads.
Webhook Payload Formatter features
- Pretty-prints JSON, decodes form-encoded bodies, keeps XML readable
- Detects the provider and event type from body and optional headers
- Highlights ids, event types, statuses, amounts, currencies, emails and URLs
- Converts Unix (seconds/milliseconds) and ISO timestamps with relative time
- Tree view, optional key sorting, size stats, live formatting
Webhook Payload Formatter example
Stripe payment_intent.succeeded
Input:
{"id":"evt_1PZx…","type":"payment_intent.succeeded","created":1725184800,"data":{"object":{"amount":19900,"currency":"sar","status":"succeeded"}}}Output:
Provider: Stripe · Event: payment_intent.succeeded · Event id: evt_1PZx…
$.data.object.amount amount 19900 199.00 if the value is in minor units
$.created timestamp 1725184800 → 2024-09-01T10:40:00.000Z (about a year ago)Frequently asked questions about Webhook Payload Formatter
What gets highlighted?
Event types, ids, statuses, amounts (with a minor-units hint), currencies, timestamps (converted to ISO 8601 and relative time), emails, names, references and URLs. Secret-looking values are masked in the table.
Can it handle form-encoded webhooks?
Yes — Twilio-style application/x-www-form-urlencoded bodies are decoded into JSON before formatting.
Does it detect the provider from the body alone?
Often: Stripe events, GitHub payloads, GitLab, PayPal, Slack, Shopify and Twilio have recognisable shapes. Adding the request headers makes detection reliable.
Is my payload uploaded?
No — formatting and detection run locally in your browser.
References
- RFC 9421: HTTP Message SignaturesA standard way to sign HTTP messages so a receiver can verify their origin and integrity — the basis of modern webhook signatures.
- RFC 2104: HMAC: Keyed-Hashing for Message AuthenticationThe HMAC construction: how a secret key and a hash function produce a message authentication code.
- OWASP Cheat Sheet Series: REST SecuritySecurity rules for REST APIs: HTTPS, authentication on every request, input validation, safe error responses, rate limiting.