Inspect webhooks

1. Turn on body capture for the workspace under Workspaces → Enable body capture. Without it you still see headers and query, but not the payload. Only the workspace owner can change it.
2. Pick a path no endpoint uses, such as /webhooks/github, and add it to your mock URL:

   https://<your-workspace>.apimock.dev/webhooks/github

3. Paste that URL into the provider's webhook settings and send a test event.
4. Open Request History and search for the path. Click the row to see headers, query and body.

You can try it without a provider:

curl -X POST https://<your-workspace>.apimock.dev/webhooks/test \
  -H "Content-Type: application/json" \
  -d '{"event":"order.paid","id":"evt_123"}'

GET, POST, PUT, PATCH and DELETE requests are logged. Request History keeps 7 days of requests, and each logged request counts towards the workspace's monthly limit.

A path with no endpoint answers 404 with an X-APIMock-Unmatched: true header. That is fine for a quick look, but most providers count anything other than a 2xx as a failed delivery and retry it, and some turn the webhook off after repeated failures.

To acknowledge deliveries, create an endpoint for the path, for example POST /webhooks/github returning status 200 and {"received": true}. Requests to it are still logged, and you can turn on Capture body previews for that endpoint alone instead of the whole workspace. To reply based on the payload, see Response templates.

• Use one path per provider (/webhooks/stripe, /webhooks/github) so you can tell them apart in the search box.
• If the provider asks for a content type, choose JSON. The body preview shows the raw text either way.
• Use the provider's “send test event” or “redeliver” button to fire events on demand, then press Refresh in Request History.
• The cURL button on a request copies it as a command aimed at your mock URL. Swap in your local server's address to replay the delivery against your own handler. Redacted headers come through as [REDACTED].

• Authorization, Cookie, Proxy-Authorization, Set-Cookie and X-API-Key headers are stored as [REDACTED].
• Query parameters whose names contain token, secret, password, api_key, authorization or cookie are redacted too.
• Bodies are not redacted. Webhook payloads can hold personal data, so turn body capture off when you are done.
• Body previews stop at 64 KiB and are marked as truncated beyond that.