Webhook Inspector

A webhook inspector is a temporary receiving surface for understanding what an external provider actually sends. It exposes the request method, headers, query parameters, body, timing, and delivery behavior before your application framework normalizes the data. That evidence is useful when a provider's documentation, signing format, or retry behavior differs from what your integration assumed.

Create a short-lived endpoint, send a test event from the provider, and compare the raw request with your expected schema. Check content type, signature headers, event identifiers, timestamps, and whether the provider retries on non-2xx responses. Treat captured payloads as sensitive: do not share tokens, customer data, or payment details in screenshots, and delete a debugging endpoint when the investigation is complete. Replays should target a controlled test URL with idempotency protection.

A parsed object can hide duplicate headers, encoding choices, canonicalization details, and the exact bytes used for a signature. Inspecting the boundary request lets you distinguish a provider delivery problem from a parser, proxy, or application bug. Once the behavior is understood, move the test into an automated fixture and verify signatures against the raw body so the temporary inspector does not become part of the production trust boundary.