# Web Hook Box > A webhook testing and debugging platform. Create a URL, point any integration at it, and > inspect every request it receives byte for byte — headers, query string, and the exact > original body. Requests can be replayed, forwarded to another URL, and exported. Base URL: https://webhook-box.com Receiving endpoint: https://webhook-box.com/webhook/{ulid} — accepts GET, POST, PUT, PATCH, DELETE, needs no authentication. API authentication: `Authorization: Bearer `, generated from the account page in the web UI. Identifiers: ULIDs in Crockford base32, for example 01ARZ3NDEKTSV4RRFFQ69G5FAV. Payloads are stored exactly as received. Nothing is normalised, re-encoded, or sanitised, because the whole point of the tool is to show what was actually sent. ## Documentation - [Documentation](https://webhook-box.com/documentation/index.md) - [Getting Started](https://webhook-box.com/documentation/getting-started.md) - [Webhooks](https://webhook-box.com/documentation/webhooks.md) - [API Reference](https://webhook-box.com/documentation/api-reference.md) - [Using Web Hook Box with AI Agents](https://webhook-box.com/documentation/ai-agents.md) - [Create Webhook](https://webhook-box.com/documentation/create-webhook.md) - [Customize Webhook](https://webhook-box.com/documentation/customize-webhook.md) - [Request Forwarding](https://webhook-box.com/documentation/request-forwarding.md) - [Replay and Export](https://webhook-box.com/documentation/replay-export.md) - [Examples](https://webhook-box.com/documentation/examples.md) - [Security](https://webhook-box.com/documentation/security.md) - [Changelog](https://webhook-box.com/documentation/changelog.md) - [FAQ](https://webhook-box.com/documentation/faq.md) ## API - [OpenAPI 3.1 specification, JSON](https://webhook-box.com/openapi.json) - [OpenAPI 3.1 specification, YAML](https://webhook-box.com/openapi.yaml) ## Agent integration - [Using Web Hook Box with AI agents](https://webhook-box.com/documentation/ai-agents) - [Model Context Protocol endpoint](https://webhook-box.com/mcp) ## Optional - [Every documentation page in one file](https://webhook-box.com/llms-full.txt) --- --- title: Documentation canonical: https://webhook-box.com/documentation last-modified: 2026-08-23 source: Web Hook Box documentation --- ## Welcome to Web Hook Box Web Hook Box is a powerful webhook testing and debugging tool designed to help developers easily receive, inspect, and manage webhook requests during development. Whether you're integrating with third-party APIs, developing webhooks for your own service, or simply need a way to inspect HTTP requests, Web Hook Box provides all the tools you need in one convenient place. ### Key Features - **Instant Webhook URLs** - Generate unique URLs to receive webhook requests - **Request Inspection** - View headers, query parameters, body, and more - **Real-Time Notifications** - See incoming requests as they happen - **Request Replay** - Easily replay webhook requests for testing - **Request Forwarding** - Forward requests to your local or production endpoints - **Export Options** - Download request logs as JSON or CSV - **Custom Responses** - Configure custom responses for your webhooks ### Getting Started New to Web Hook Box? Here's how to get started: 1. [Create an account](/documentation/getting-started) or sign in with your existing account 2. [Create your first webhook](/documentation/create-webhook) to get a unique URL 3. Configure the webhook URL in the third-party service or application 4. Watch requests come in real-time in your dashboard 5. Inspect, replay, or forward requests as needed [Read the Getting Started Guide](/documentation/getting-started) ### Documentation Sections #### Guides - [Getting Started](/documentation/getting-started) - [Creating Webhooks](/documentation/create-webhook) - [Customizing Webhooks](/documentation/customize-webhook) #### Advanced Usage - [Request Forwarding](/documentation/request-forwarding) - [Replaying & Exporting](/documentation/replay-export) - [API Reference](/documentation/api-reference) #### Reference - [Security Guidelines](/documentation/security) - [Changelog](/documentation/changelog) - [FAQ & Troubleshooting](/documentation/faq) --- --- title: Getting Started canonical: https://webhook-box.com/documentation/getting-started last-modified: 2026-08-23 source: Web Hook Box documentation --- # Getting Started with Web Hook Box This guide will walk you through the basics of setting up and using Web Hook Box for testing and debugging your webhook integrations. ##### Create an Account Sign up for a Web Hook Box account to get started with your webhook testing journey. [Learn More](#account-creation) ##### Create a Webhook Generate a unique webhook URL that you can use to receive HTTP requests. [Learn More](#create-webhook) ##### Start Testing Use your webhook URL with third-party services or your own applications. [Learn More](#testing) ## Creating Your Account Getting started with Web Hook Box is simple: 1. **Visit the Sign Up Page**Navigate to our registration page to create a new account. 2. **Choose Your Authentication Method**You can sign up using your email address and password or use a social login option like Google or GitHub. 3. **Verify Your Email**If you sign up with email, you'll need to verify your email address by clicking the link in the confirmation email we send you. 4. **Complete Your Profile**While optional, completing your profile helps us provide a better experience and allows us to notify you of important updates. ##### Pro Tip After creating your account, take a moment to explore the dashboard and familiarize yourself with the layout. This will make it easier to navigate as you start using the platform. ## Creating Your First Webhook Once you've created your account, you can create your first webhook: 1. **Navigate to the Dashboard**After logging in, you'll land on your dashboard. This is where you'll manage all your webhooks. 2. **Click "Create Webhook"**Look for the "Create Webhook" button on your dashboard and click it to start the creation process. ![Create Webhook Button](/images/docs/create-webhook-button.jpg) 3. **Configure Your Webhook (Optional)**You can provide a description for your webhook to help you identify it later. You can also configure advanced settings like: - Custom responses - Request forwarding - Authentication requirements Don't worry, you can always change these settings later. 4. **Save Your Webhook**Click "Create" to generate your unique webhook URL. This URL will be used to receive HTTP requests. ##### Your Webhook URL Your webhook URL will look something like this: ``` https://webhook-box.com/webhook/abc123def456ghi789 ``` This URL is unique to your webhook and won't change unless you regenerate it. You can copy it to your clipboard directly from the dashboard. ## Testing Your Webhook Now that you have your webhook URL, you can start using it to receive webhook requests: ## Testing with Third-Party Services To test your webhook with a third-party service: 1. Go to the third-party service that supports webhooks (e.g., GitHub, Stripe, Shopify) 2. Find their webhook settings (often in a "Settings," "Integrations," or "Webhooks" section) 3. Add a new webhook and enter your Web Hook Box URL 4. Configure any other required settings (e.g., events to trigger the webhook) 5. Save the webhook configuration The third-party service will now send HTTP requests to your webhook URL whenever the configured events occur. ## Manual Testing with cURL You can also manually test your webhook using cURL: ``` # Send a GET request curl https://webhook-box.com/webhook/your-webhook-id # Send a POST request with JSON data curl -X POST \ -H "Content-Type: application/json" \ -d '{"key": "value", "event": "test"}' \ https://webhook-box.com/webhook/your-webhook-id ``` ## Testing in Your Application If you're developing an application that sends webhooks, you can use your Web Hook Box URL during development: ``` // Node.js example const axios = require('axios'); async function sendWebhook() { try { await axios.post('https://webhook-box.com/webhook/your-webhook-id', { event: 'order.created', data: { order_id: '12345', customer: 'John Doe', total: 99.99 } }); console.log('Webhook sent successfully'); } catch (error) { console.error('Error sending webhook:', error); } } sendWebhook(); ``` ## Viewing Webhook Requests Once your webhook starts receiving requests, you can view them in your dashboard: 1. **Go to Your Dashboard**Navigate to your Web Hook Box dashboard and find the webhook you created. 2. **Click on the Webhook**Click on the webhook to view its details page, which includes a list of all received requests. 3. **Explore Request Details**Click on any request to view its detailed information, including: - HTTP method (GET, POST, etc.) - Headers - Query parameters - Request body - Timestamp ##### Real-Time Notifications Web Hook Box provides real-time notifications when your webhook receives new requests. Keep your dashboard open to see requests as they arrive. ## Next Steps Now that you've set up your first webhook and started receiving requests, here are some next steps to explore: ##### Customize Your Webhook Learn how to configure custom responses, add headers, and modify status codes for your webhook. [View Guide](/documentation/customize-webhook) ##### Request Forwarding Forward incoming webhook requests to your local or production environment for end-to-end testing. [View Guide](/documentation/request-forwarding) ##### Replay Requests Learn how to replay webhook requests to test your endpoint's behavior without waiting for new events. [View Guide](/documentation/replay-export) ##### API Integration Explore our API to programmatically create and manage webhooks in your workflows. [View API Docs](/documentation/api-reference) --- --- title: Webhooks canonical: https://webhook-box.com/documentation/webhooks last-modified: 2026-08-23 source: Web Hook Box documentation --- # Understanding Webhooks ## What are Webhooks? Webhooks are user-defined HTTP callbacks that are triggered by specific events in a web application. Think of webhooks as a way for applications to communicate with each other in real-time. Instead of constantly polling an API to check if something has changed, webhooks allow a server to push data to another application as soon as an event occurs. For example, when a new payment is processed in a payment gateway, a webhook can be triggered to notify your application about the successful transaction, allowing you to update your records, send confirmation emails, or trigger other processes automatically. ### How Webhooks Work 1. An **event** happens in a source system (e.g., new order, payment, comment) 2. The source system sends an HTTP request (usually POST) to the **webhook URL** you provided 3. Your application receives this request with event data and processes it accordingly 4. Your application returns an HTTP response (typically 200 OK) to acknowledge receipt ![Webhook Flow Diagram](/images/docs/webhook-flow.png) ##### Web Hook Box Your comprehensive webhook testing platform. ##### Links - [Features](/features) - [Documentation](/documentation) ##### Contact - --- [ Buy me a coffee ](https://buymeacoffee.com/mouhammeddn) © 2026 Web Hook Box. All rights reserved. --- --- title: API Reference canonical: https://webhook-box.com/documentation/api-reference last-modified: 2026-08-23 source: Web Hook Box documentation --- # API Reference Complete reference for the Web Hook Box REST API. ##### API Base URL All API requests should be made to: `https://webhook-box.com/api/v1/` Web Hook Box provides a comprehensive RESTful API that allows you to programmatically create and manage webhook endpoints, access webhook request data, and more. This reference documents all available endpoints and their parameters. ##### API Features - Create, update, and delete webhook endpoints - Access webhook request data and metadata - Configure response behavior and request forwarding - Manage user account settings and API keys - Access usage statistics and logs ##### On This Page - [Overview](#overview) - [Authentication](#authentication) - [API Endpoints](#endpoints) - [Webhook API](#webhooks) - [Request API](#requests) - [User API](#users) - [Error Handling](#errors) ## Authentication All API requests require authentication using an API token. ##### Authentication Methods ###### Bearer Token (Recommended) Include your API token in the Authorization header: ``` Authorization: Bearer YOUR_API_TOKEN ``` ###### Query Parameter Alternatively, you can include the token as a query parameter: ``` https://webhook-box.com/api/v1/webhooks?token=YOUR_API_TOKEN ``` **Security Note:** Query parameter authentication is less secure as tokens may be logged in server logs. ##### Managing API Tokens You can create and manage API tokens from your account settings page. We recommend creating separate tokens for different applications or services. ##### Security Best Practices - Keep your API tokens secure and never expose them in client-side code - Rotate tokens regularly and revoke unused ones - Set appropriate permissions for each token - Use separate tokens for development and production environments ## API Endpoints Overview The Web Hook Box API is organized around the following resource groups: Resource Base Path Description **Webhooks** `/webhooks` Create and manage webhook endpoints **Requests** `/webhooks/{id}/requests` Access and manage webhook request data **User** `/user` Manage user account settings **Tokens** `/tokens` Manage API tokens **Tip:** For code examples of common API operations, check out the [Code Examples](/documentation/examples) section. ## Webhook API These endpoints allow you to create and manage webhook endpoints. ##### List Webhooks GET `/webhooks` Retrieve a list of all webhooks for the authenticated user. ###### Query Parameters - `page` - Page number for pagination (default: 1) - `limit` - Number of results per page (default: 20, max: 100) - `tag` - Filter webhooks by tag ###### Response ``` { "webhooks": [ { "id": "abc123def456...", "url": "https://webhook-box.com/webhook/abc123def456...", "description": "Payment Webhook", "tags": ["payment", "stripe"], "created_at": "2023-06-15T12:30:45Z", "request_count": 157 }, ... ], "pagination": { "page": 1, "limit": 20, "total": 42, "pages": 3 } } ``` ##### Create Webhook POST `/webhooks` Create a new webhook endpoint. ###### Request Body ``` { "description": "Payment Notification Webhook", "tags": ["payment", "stripe"], "custom_response": { "status_code": 200, "headers": { "Content-Type": "application/json" }, "body": "{\"status\":\"success\"}" }, "forward_url": "https://myapp.example.com/webhooks/payment" } ``` ###### Response ``` { "id": "abc123def456...", "url": "https://webhook-box.com/webhook/abc123def456...", "description": "Payment Notification Webhook", "tags": ["payment", "stripe"], "created_at": "2023-07-12T08:45:30Z", "custom_response": { "status_code": 200, "headers": { "Content-Type": "application/json" }, "body": "{\"status\":\"success\"}" }, "forward_url": "https://myapp.example.com/webhooks/payment", "request_count": 0 } ``` ##### Get Webhook GET `/webhooks/{id}` Retrieve details for a specific webhook. ###### Path Parameters - `id` - The webhook ID ###### Response ``` { "id": "abc123def456...", "url": "https://webhook-box.com/webhook/abc123def456...", "description": "Payment Notification Webhook", "tags": ["payment", "stripe"], "created_at": "2023-07-12T08:45:30Z", "custom_response": { "status_code": 200, "headers": { "Content-Type": "application/json" }, "body": "{\"status\":\"success\"}" }, "forward_url": "https://myapp.example.com/webhooks/payment", "request_count": 42, "last_request_at": "2023-07-15T14:23:12Z" } ``` ## Request API These endpoints allow you to access and manage webhook request data. ##### List Requests GET `/webhooks/{webhook_id}/requests` Retrieve a list of requests for a specific webhook. ###### Path Parameters - `webhook_id` - The webhook ID ###### Query Parameters - `page` - Page number for pagination (default: 1) - `limit` - Number of results per page (default: 20, max: 100) - `method` - Filter by HTTP method (e.g., GET, POST) - `from` - Filter by date range start (ISO 8601 format) - `to` - Filter by date range end (ISO 8601 format) ###### Response ``` { "requests": [ { "id": "req123abc456...", "webhook_id": "abc123def456...", "method": "POST", "headers": { "Content-Type": "application/json", "User-Agent": "Stripe/1.0" }, "query_params": { "source": "dashboard" }, "body_size": 1256, "ip_address": "203.0.113.42", "created_at": "2023-07-15T14:23:12Z" }, ... ], "pagination": { "page": 1, "limit": 20, "total": 157, "pages": 8 } } ``` ##### Get Request GET `/webhooks/{webhook_id}/requests/{request_id}` Retrieve details for a specific webhook request, including full request body. ###### Path Parameters - `webhook_id` - The webhook ID - `request_id` - The request ID ###### Response ``` { "id": "req123abc456...", "webhook_id": "abc123def456...", "method": "POST", "headers": { "Content-Type": "application/json", "User-Agent": "Stripe/1.0", "Stripe-Signature": "t=1626349874,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd" }, "query_params": { "source": "dashboard" }, "body": "{\"id\":\"evt_1JFzUEKX7w9RzW5v\",\"object\":\"event\",\"api_version\":\"2020-08-27\",\"created\":1626349873,\"data\":{\"object\":{\"id\":\"ch_1JFzUDKX7w9RzW5v\",\"object\":\"charge\",\"amount\":2000,\"currency\":\"usd\"}},\"type\":\"charge.succeeded\"}", "ip_address": "203.0.113.42", "created_at": "2023-07-15T14:23:12Z", "forwarding": { "url": "https://myapp.example.com/webhooks/payment", "status": "success", "status_code": 200, "response_time": 235, "response_headers": { "Content-Type": "application/json" }, "response_body": "{\"received\":true,\"processed\":true}" } } ``` ## User API These endpoints allow you to manage user account settings. ##### Get User Profile GET `/user` Retrieve the user profile for the authenticated user. ###### Response ``` { "id": "usr123abc456...", "email": "user@example.com", "name": "John Doe", "created_at": "2023-01-15T08:30:45Z", "subscription": { "plan": "pro", "status": "active", "expires_at": "2024-01-15T08:30:45Z" }, "usage": { "webhook_count": 12, "request_count": 1574, "storage_used": 2.45 // in MB } } ``` ##### Update User Profile PATCH `/user` Update the user profile for the authenticated user. ###### Request Body ``` { "name": "John Smith", "notification_preferences": { "email_notifications": true, "webhook_alerts": true } } ``` ###### Response ``` { "id": "usr123abc456...", "email": "user@example.com", "name": "John Smith", "created_at": "2023-01-15T08:30:45Z", "notification_preferences": { "email_notifications": true, "webhook_alerts": true }, "subscription": { "plan": "pro", "status": "active", "expires_at": "2024-01-15T08:30:45Z" } } ``` ## Error Handling Web Hook Box API uses conventional HTTP response codes to indicate the success or failure of an API request. Code Description `200 - OK` The request was successful. `201 - Created` The request has been fulfilled and a new resource has been created. `400 - Bad Request` The request was invalid or cannot be otherwise served. `401 - Unauthorized` Authentication failed or user doesn't have permissions. `404 - Not Found` The requested resource does not exist. `429 - Too Many Requests` The user has sent too many requests in a given amount of time. `500, 502, 503, 504 - Server Errors` Something went wrong on the server. ##### Error Response Format Error responses include a JSON object with detailed information: ``` { "error": { "code": "invalid_request", "message": "The webhook ID is invalid or does not exist.", "status": 404, "request_id": "req_7HF9a8sJdK3l2M" } } ``` ##### Handling Errors Always check for error responses in your API clients and handle them appropriately. The `request_id` field can be useful when contacting support about a specific API issue. ## Rate Limiting Web Hook Box implements rate limiting to protect our infrastructure and ensure fair usage across all users. ##### Rate Limit Headers Each API response includes headers that indicate your current rate limit status: - `X-RateLimit-Limit`: The maximum number of requests you're permitted to make per hour. - `X-RateLimit-Remaining`: The number of requests remaining in the current rate limit window. - `X-RateLimit-Reset`: The time at which the current rate limit window resets (UTC epoch seconds). If you exceed the rate limit, you'll receive a `429 Too Many Requests` response with a `Retry-After` header indicating how long to wait before making another request. ##### Rate Limit Tiers Plan Rate Limit Free 60 requests per hour Basic 300 requests per hour Pro 1,000 requests per hour Enterprise Custom limits --- --- title: Using Web Hook Box with AI Agents canonical: https://webhook-box.com/documentation/ai-agents last-modified: 2026-08-23 source: Web Hook Box documentation --- Web Hook Box publishes everything an AI coding agent needs to use it without a human reading the documentation aloud: a machine-readable API contract, the documentation in markdown, and a Model Context Protocol server that turns the API into tools. ## What is published - [`/openapi.json`](/openapi.json) — the full API contract, OpenAPI 3.1. Also available as [`/openapi.yaml`](/openapi.yaml). - [`/llms.txt`](/llms.txt) — an index of this site written for language models, and [`/llms-full.txt`](/llms-full.txt) with every page inlined. - Every documentation page in markdown: append `.md` to its URL, or send `Accept: text/markdown`. - `/mcp` — the Model Context Protocol endpoint described below. ## Connecting an agent over MCP Generate an API token from your account page, then register the endpoint with your client. For Claude Code: ``` claude mcp add --transport http webhookbox https://webhook-box.com/mcp --header "Authorization: Bearer $WEBHOOKBOX_TOKEN" ``` Any client that speaks Streamable HTTP MCP works the same way: the endpoint is `https://webhook-box.com/mcp` and authentication is a bearer token. ### Tools ToolWhat it does `list_webhooks`Lists the endpoints on the account. `create_webhook`Creates an endpoint and returns its receiving URL. `get_webhook`Reads one endpoint's configuration. `update_webhook`Changes description, active state, or forwarding. `delete_webhook`Deletes an endpoint and everything it captured. Irreversible. `list_requests`Lists the requests an endpoint captured. `get_request`Reads one captured request in full, body byte for byte. `get_request_as_curl`Renders a captured request as a runnable curl command. `replay_request`Sends a captured request again. Has real side effects. Bodies are never sent to a model in full by default. `list_requests` summarises each captured body as `{size, preview, truncated, encoding}`; `get_request` returns the whole body as `{content, encoding}`. `encoding` is `"utf8"` or `"base64"` — a binary payload comes back base64-encoded rather than mangled, so the exact original bytes are still recoverable. Either shape is cut off past a byte limit, with a notice pointing back at the REST API for the untruncated value. The documentation is also published to connected clients as MCP resources under `webhookbox://docs/`, so an agent can read these pages over the same connection. `delete_webhook` and `replay_request` are annotated as destructive and side-effecting, so a well-behaved client asks before running them. The endpoint is limited to 60 calls a minute per token. ## Without MCP An agent with no MCP support can be pointed at the OpenAPI document and use the REST API directly. A prompt as short as this is usually enough: ``` The Web Hook Box API is described at https://webhook-box.com/openapi.json. Authenticate with `Authorization: Bearer $WEBHOOKBOX_TOKEN`. Create a webhook, tell me its URL, then poll its captured requests until one arrives. ``` ## Things worth asking an agent to do - Create a throwaway endpoint and hand back the URL to paste into a provider's dashboard. - Watch for the next captured request and report the headers and body it saw. - Compare two captured requests and describe what changed between them. - Turn a captured request into a curl command so it can be reproduced from a terminal. - Replay a captured request after a fix has been deployed. ## Before you connect an agent **An agent holding your API token can read every request your webhooks have captured.** Captured payloads routinely contain provider signatures, bearer tokens, and personal data, and whatever a tool returns lands in the model's context — and, depending on the client, in a model transcript and in logs outside this platform. Connect an agent only to an account whose captured payloads you would accept appearing in a model transcript. For agent-driven testing against production-shaped traffic, use a separate account rather than your main one. Read-only tokens and payload redaction are not implemented today. A token is a token: it grants everything the account can do, including deleting webhooks. --- --- title: Create Webhook canonical: https://webhook-box.com/documentation/create-webhook last-modified: 2026-08-23 source: Web Hook Box documentation --- # Creating Webhooks Learn how to create new webhook endpoints using Web Hook Box's UI or API. ##### What You'll Learn - How to create webhooks through the Web Hook Box dashboard - How to programmatically create webhooks using the API - Available webhook configuration options - Security considerations when creating webhooks ## Creating Webhooks Using the Dashboard The quickest way to create a new webhook is through the Web Hook Box dashboard. ##### Step-by-Step Instructions 1. Login to your Web Hook Box account 2. Navigate to your dashboard 3. Click the **"Create Webhook"** button in the top right corner 4. Fill in the webhook details: - **Description:** An optional name or description to identify your webhook - **Tags:** Optional tags to categorize and filter your webhooks 5. Click **"Create Webhook"** to generate your endpoint ![Create Webhook Form](/images/docs/create-webhook-form.png)The webhook creation form in the dashboard After clicking "Create Webhook", your new webhook will be instantly created with a unique URL. This URL will be displayed on the screen and can be copied for immediate use. ##### Your Webhook Is Ready! Your webhook is immediately active and ready to receive requests. The URL format is: `https://webhook-box.com/webhook/abc123def456...`This URL is unique to your webhook and should be provided to the services that will be sending webhook events. ##### Web Hook Box Your comprehensive webhook testing platform. ##### Links - [Features](/features) - [Documentation](/documentation) ##### Contact - --- [ Buy me a coffee ](https://buymeacoffee.com/mouhammeddn) © 2026 Web Hook Box. All rights reserved. --- --- title: Customize Webhook canonical: https://webhook-box.com/documentation/customize-webhook last-modified: 2026-08-23 source: Web Hook Box documentation --- # Customize Your Webhook Learn how to customize your webhook endpoints with features like custom responses, header transforms, and more. ## Custom Responses With Web Hook Box, you can configure custom HTTP responses for your webhook endpoints. This is particularly useful when integrating with third-party services that expect specific responses when delivering webhooks. ### Response Configuration Options - **Status Code:** Set any HTTP status code for your webhook response - **Headers:** Add custom HTTP headers to your response - **Body Content:** Define custom response body content - **Content Type:** Specify the content type of your response (JSON, XML, etc.) ### How to Configure Custom Responses 1. Navigate to your webhook details in the dashboard 2. Click on the "Customize Response" tab 3. Enter your desired status code (default is 200) 4. Add any custom headers using the key-value editor 5. Enter the response body content 6. Select the appropriate content type 7. Save your configuration #### Example Custom Response Configuration **Status Code:** 200 **Headers:** ``` Content-Type: application/json X-Webhook-Processed: true ``` **Body:** ``` { "status": "success", "message": "Webhook received successfully", "timestamp": "2023-07-15T14:22:34Z" } ``` ## Header Transformations For donor accounts, Web Hook Box allows you to transform headers before forwarding webhooks. This feature helps you adapt to different webhook providers' requirements. ### Available Header Transformations - **Add Headers:** Include additional headers when forwarding - **Remove Headers:** Exclude specific headers - **Rename Headers:** Change header names for compatibility - **Transform Values:** Modify header values using simple expressions Header transformations are only applied when forwarding webhooks, not when storing them. ## Webhook Filtering Donor accounts can set up filtering rules to determine which webhooks are processed, forwarded, or stored. This helps reduce noise and focus on the webhooks that matter to your application. ### Filter Types #### Path-based Filtering Filter webhooks based on their request path patterns **Example:** `/payments/*` to only process webhooks related to payments #### Header-based Filtering Filter webhooks based on header values **Example:** `X-Event-Type: payment.created` to only process payment creation events #### Body Content Filtering Filter webhooks based on their payload content **Example:** `$.event.type == "user.created"` to process specific event types #### IP Address Filtering Filter webhooks based on source IP addresses **Example:** Whitelist or blacklist IPs for enhanced security [Next: Configure Request Forwarding](/documentation/request-forwarding) --- --- title: Request Forwarding canonical: https://webhook-box.com/documentation/request-forwarding last-modified: 2026-08-23 source: Web Hook Box documentation --- # Request Forwarding Request forwarding allows you to relay incoming webhook data to your own endpoints or services, providing a convenient way to test webhooks with your applications without exposing them directly. ## What is Request Forwarding? Request forwarding is a feature that allows Web Hook Box to act as a proxy between external services and your applications. When a webhook request is received, Web Hook Box can automatically forward that request to one or more target URLs. This provides several benefits: - Inspect and debug webhook payloads without modifying your application - Forward the same webhook to multiple destinations - Keep a history of all webhook requests for reference - Test your webhook handlers without exposing your local development environment - Filter and transform webhook payloads before they reach your application ![Request Forwarding Flow](/images/docs/request-forwarding-flow.png) ##### Web Hook Box Your comprehensive webhook testing platform. ##### Links - [Features](/features) - [Documentation](/documentation) ##### Contact - --- [ Buy me a coffee ](https://buymeacoffee.com/mouhammeddn) © 2026 Web Hook Box. All rights reserved. --- --- title: Replay and Export canonical: https://webhook-box.com/documentation/replay-export last-modified: 2026-08-23 source: Web Hook Box documentation --- # Replaying & Exporting Webhooks Web Hook Box provides powerful tools for replaying webhook requests and exporting webhook data in various formats, helping you with debugging, testing, and integration. ## Webhook Replay The webhook replay feature allows you to resend previously received webhook requests to your endpoints, which is useful for: - Testing fixes to your webhook handler without waiting for a new webhook event - Debugging issues with specific webhook payloads - Reproducing webhook scenarios during development - Recovering from endpoint downtime by replaying missed webhooks #### Replay Options ##### Exact Replay Sends the webhook exactly as it was originally received, with the same headers, body, and HTTP method. ##### Web Hook Box Your comprehensive webhook testing platform. ##### Links - [Features](/features) - [Documentation](/documentation) ##### Contact - --- [ Buy me a coffee ](https://buymeacoffee.com/mouhammeddn) © 2026 Web Hook Box. All rights reserved. --- --- title: Examples canonical: https://webhook-box.com/documentation/examples last-modified: 2026-08-23 source: Web Hook Box documentation --- # Code Examples This page contains code examples in different programming languages to help you integrate with Web Hook Box. - PHP - JavaScript - Python - Ruby - Go ## Creating a Webhook via API This example shows how to create a new webhook using the Web Hook Box API: ``` // Creating a webhook using PHP and cURL $apiToken = 'YOUR_API_TOKEN'; $url = 'https://webhookbox.example.com/api/webhooks'; $data = [ 'description' => 'My test webhook', 'forwardUrl' => 'https://myapp.example.com/webhook-receiver', 'enableForwarding' => true ]; $ch = curl_init($url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data)); curl_setopt($ch, CURLOPT_HTTPHEADER, [ 'Authorization: Bearer ' . $apiToken, 'Content-Type: application/json' ]); $response = curl_exec($ch); $statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); if ($statusCode === 201) { $webhook = json_decode($response, true); echo "Webhook created successfully! URL: " . $webhook['url']; } else { echo "Error creating webhook: " . $response; } ``` Using Guzzle HTTP client: ``` // Using Guzzle HTTP client use GuzzleHttp\Client; $client = new Client(); $apiToken = 'YOUR_API_TOKEN'; try { $response = $client->post('https://webhookbox.example.com/api/webhooks', [ 'headers' => [ 'Authorization' => 'Bearer ' . $apiToken, 'Content-Type' => 'application/json', ], 'json' => [ 'description' => 'My test webhook', 'forwardUrl' => 'https://myapp.example.com/webhook-receiver', 'enableForwarding' => true ] ]); $webhook = json_decode($response->getBody(), true); echo "Webhook created successfully! URL: " . $webhook['url']; } catch (\Exception $e) { echo "Error creating webhook: " . $e->getMessage(); } ``` ## Receiving and Processing Webhooks This example shows how to receive and process incoming webhooks: ``` // webhook-receiver.php // Receive and process incoming webhooks // Get the raw payload $payload = file_get_contents('php://input'); $headers = getallheaders(); // Log the incoming webhook (optional) file_put_contents( 'webhook_log.txt', date('[Y-m-d H:i:s]') . " Received webhook:\n" . json_encode([ 'headers' => $headers, 'payload' => json_decode($payload, true) ], JSON_PRETTY_PRINT) . "\n\n", FILE_APPEND ); // Process the webhook based on content type $contentType = $_SERVER['CONTENT_TYPE'] ?? ''; if (strpos($contentType, 'application/json') !== false) { $data = json_decode($payload, true); // Handle the webhook data if (isset($data['event'])) { switch ($data['event']) { case 'payment.success': // Handle successful payment processSuccessfulPayment($data); break; case 'user.created': // Handle user creation processNewUser($data); break; default: // Handle unknown event type logUnknownEvent($data); break; } } } // Always respond with a 200 OK to acknowledge receipt http_response_code(200); echo json_encode(['status' => 'received']); // Example processing functions function processSuccessfulPayment($data) { // Implementation for processing payments } function processNewUser($data) { // Implementation for handling new users } function logUnknownEvent($data) { // Log unknown event types for later analysis } ``` Using Symfony framework: ``` // Using Symfony framework namespace App\Controller; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Annotation\Route; use Psr\Log\LoggerInterface; class WebhookController extends AbstractController { #[Route('/webhook-receiver', methods: ['POST'])] public function receive(Request $request, LoggerInterface $logger): Response { // Get the raw payload $payload = $request->getContent(); $data = json_decode($payload, true); // Log the incoming webhook $logger->info('Received webhook', [ 'headers' => $request->headers->all(), 'payload' => $data ]); // Process the webhook if (isset($data['event'])) { switch ($data['event']) { case 'payment.success': // Handle payment $this->processPayment($data); break; // Handle other events... } } // Always acknowledge receipt return $this->json(['status' => 'received']); } private function processPayment(array $data): void { // Implementation } } ``` ## Fetching Webhook Requests This example shows how to fetch webhook requests from the API: ``` // Fetching webhook requests using PHP $apiToken = 'YOUR_API_TOKEN'; $webhookUuid = 'YOUR_WEBHOOK_UUID'; $url = "https://webhookbox.example.com/api/webhooks/{$webhookUuid}/requests"; $ch = curl_init($url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, [ 'Authorization: Bearer ' . $apiToken ]); $response = curl_exec($ch); $statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); if ($statusCode === 200) { $data = json_decode($response, true); echo "Found " . $data['total'] . " webhook requests\n"; foreach ($data['items'] as $request) { echo "Request ID: " . $request['id'] . "\n"; echo "Received at: " . $request['receivedAt'] . "\n"; echo "Method: " . $request['httpMethod'] . "\n"; echo "----------------------------------------\n"; } } else { echo "Error fetching webhook requests: " . $response; } ``` ## Creating a Webhook (Node.js) This example shows how to create a new webhook using Node.js: ``` // Creating a webhook using Node.js and fetch const createWebhook = async () => { const apiToken = 'YOUR_API_TOKEN'; const url = 'https://webhookbox.example.com/api/webhooks'; try { const response = await fetch(url, { method: 'POST', headers: { 'Authorization': `Bearer ${apiToken}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ description: 'My test webhook', forwardUrl: 'https://myapp.example.com/webhook-receiver', enableForwarding: true }) }); if (!response.ok) { throw new Error(`HTTP error! Status: ${response.status}`); } const webhook = await response.json(); console.log(`Webhook created successfully! URL: ${webhook.url}`); return webhook; } catch (error) { console.error('Error creating webhook:', error); } }; createWebhook(); ``` Using axios: ``` // Using axios const axios = require('axios'); const createWebhook = async () => { const apiToken = 'YOUR_API_TOKEN'; const url = 'https://webhookbox.example.com/api/webhooks'; try { const response = await axios.post(url, { description: 'My test webhook', forwardUrl: 'https://myapp.example.com/webhook-receiver', enableForwarding: true }, { headers: { 'Authorization': `Bearer ${apiToken}`, 'Content-Type': 'application/json' } }); console.log(`Webhook created successfully! URL: ${response.data.url}`); return response.data; } catch (error) { console.error('Error creating webhook:', error.response ? error.response.data : error.message); } }; createWebhook(); ``` ## Receiving Webhooks (Express.js) This example shows how to receive and process incoming webhooks with Express.js: ``` // Using Express.js to receive webhooks const express = require('express'); const bodyParser = require('body-parser'); const app = express(); const port = process.env.PORT || 3000; // Parse JSON bodies app.use(bodyParser.json()); // Webhook receiver endpoint app.post('/webhook-receiver', (req, res) => { const payload = req.body; const headers = req.headers; // Log the incoming webhook console.log('Received webhook:', { headers, payload }); // Process the webhook based on event type if (payload.event) { switch(payload.event) { case 'payment.success': processPayment(payload); break; case 'user.created': processNewUser(payload); break; default: console.log('Unknown event type:', payload.event); } } // Always acknowledge receipt res.status(200).json({ status: 'received' }); }); function processPayment(data) { // Implementation for processing payments console.log('Processing payment:', data.id); } function processNewUser(data) { // Implementation for handling new users console.log('Processing new user:', data.user.email); } // Start the server app.listen(port, () => { console.log(`Webhook receiver listening at http://localhost:${port}`); }); ``` ## Creating and Managing Webhooks This example shows how to create and manage webhooks using Python: ``` import requests import json # API configuration API_TOKEN = 'YOUR_API_TOKEN' API_BASE_URL = 'https://webhookbox.example.com/api' HEADERS = { 'Authorization': f'Bearer {API_TOKEN}', 'Content-Type': 'application/json' } def create_webhook(description, forward_url=None, enable_forwarding=False): """ Create a new webhook """ url = f"{API_BASE_URL}/webhooks" payload = { 'description': description, 'forwardUrl': forward_url, 'enableForwarding': enable_forwarding } response = requests.post(url, headers=HEADERS, json=payload) if response.status_code == 201: webhook = response.json() print(f"Webhook created successfully! URL: {webhook['url']}") return webhook else: print(f"Error creating webhook: {response.text}") return None def list_webhooks(page=1, limit=20): """ List all webhooks """ url = f"{API_BASE_URL}/webhooks?page={page}&limit={limit}" response = requests.get(url, headers=HEADERS) if response.status_code == 200: data = response.json() print(f"Found {data['total']} webhooks") return data['items'] else: print(f"Error listing webhooks: {response.text}") return [] def get_webhook_requests(webhook_uuid, page=1, limit=20): """ Get requests for a specific webhook """ url = f"{API_BASE_URL}/webhooks/{webhook_uuid}/requests?page={page}&limit={limit}" response = requests.get(url, headers=HEADERS) if response.status_code == 200: data = response.json() print(f"Found {data['total']} requests for webhook {webhook_uuid}") return data['items'] else: print(f"Error getting webhook requests: {response.text}") return [] # Example usage if __name__ == "__main__": # Create a new webhook webhook = create_webhook( description="My Python webhook", forward_url="https://myapp.example.com/webhook-receiver", enable_forwarding=True ) if webhook: # List all webhooks webhooks = list_webhooks() # Get requests for the new webhook if webhook.get('id'): requests = get_webhook_requests(webhook['id']) ``` ## Receiving Webhooks (Flask) This example shows how to receive webhooks with Flask: ``` from flask import Flask, request, jsonify import logging import json from datetime import datetime app = Flask(__name__) # Configure logging logging.basicConfig( level=logging.INFO, format='%(asctime)s - %(name)s - %(levelname)s - %(message)s', filename='webhooks.log' ) logger = logging.getLogger(__name__) @app.route('/webhook-receiver', methods=['POST']) def webhook_handler(): """ Handle incoming webhooks """ # Get data from request payload = request.json headers = dict(request.headers) # Log the webhook logger.info("Received webhook: %s", json.dumps({ 'headers': headers, 'payload': payload })) # Process webhook based on event type if payload and 'event' in payload: event_type = payload['event'] if event_type == 'payment.success': process_payment(payload) elif event_type == 'user.created': process_new_user(payload) else: logger.warning("Unknown event type: %s", event_type) # Always acknowledge receipt return jsonify({'status': 'received', 'timestamp': datetime.utcnow().isoformat()}) def process_payment(data): """Process payment webhook data""" logger.info("Processing payment: %s", data.get('id')) # Implementation here def process_new_user(data): """Process new user webhook data""" logger.info("Processing new user: %s", data.get('user', {}).get('email')) # Implementation here if __name__ == '__main__': app.run(debug=True, host='0.0.0.0', port=5000) ``` Ruby examples coming soon. Go examples coming soon. #### Have a different use case? These examples demonstrate common scenarios, but we're always adding more examples for different languages and frameworks. If you need help with a specific integration not covered here, please [contact our support team](#). --- --- title: Security canonical: https://webhook-box.com/documentation/security last-modified: 2026-08-23 source: Web Hook Box documentation --- # Security & Privacy Web Hook Box takes security and privacy seriously. This document outlines our security practices and provides guidance on securely using our service. ## Data Security We implement multiple layers of security to protect your webhook data: ### Transport Security - TLS 1.3 for all connections - HTTPS-only connections enforced - Modern cipher suites - HSTS headers implemented ### Authentication - Firebase Authentication integration - Multi-provider OAuth support - Secure token handling - Session timeout protection ## API Token Security Our API token system is designed with security best practices in mind: ### Token Generation & Storage - Cryptographically secure random generation - Tokens are hashed before storage - Only shown once at generation time - Hidden by default in UI with show/hide toggle - Immediate revocation capability ### Best Practices for Users - Treat API tokens like passwords - Never store tokens in client-side code - Use environment variables for token storage - Rotate tokens periodically - Revoke tokens when no longer needed - Use separate tokens for different applications #### Important Security Notice Your API token provides full access to your account's API functionality. Never share your token with others, include it in public repositories, or expose it in client-side code. ## User Account Security Your account security is enhanced through several features: ### Profile Management Your [profile page](/user/profile) provides secure access to account information and API token management. - Securely view and manage your account information - Generate and revoke API tokens - View your account creation date ### Firebase Authentication We leverage Firebase Authentication for secure account management: - Email and password authentication with security best practices - OAuth integration with Google and GitHub - Secure password reset workflows - Token-based authentication with secure handling ## Privacy Policy For more information about how we handle your data, please refer to our [Privacy Policy](#privacy-policy). --- --- title: Changelog canonical: https://webhook-box.com/documentation/changelog last-modified: 2026-08-23 source: Web Hook Box documentation --- # Changelog Track all notable changes to Web Hook Box. We follow [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) principles. ## Unreleased - October 2025 ### Fixed - **Critical: Request Body Storage** - Fixed a critical bug where webhook request bodies were always empty. The payload persistence logic was only storing body content when validation failed, not when it succeeded. Now all valid payloads are properly captured and stored. ## v1.3.0 - October 14, 2025 ### Added - **Automated Code Review** - Implemented GitHub workflows for automated code review and PR assistance - **Developer Documentation** - Added comprehensive development guidelines and architecture documentation ### Improved - **Payload Storage** - Enhanced payload validation and storage logic with better error handling - **Content Type Detection** - Improved content type mismatch detection and reporting - **Error Logging** - Added detailed logging when payload persistence fails ### Fixed - **Duplicate Headers** - Fixed duplicate X-Content-Type-Mismatch header in responses - **Payload Preservation** - Original content is now preserved even when validation fails - **Empty Body Handling** - Improved handling of empty request bodies ## v1.2.0 - June 2025 ### Improved - **Framework Upgrade** - Upgraded to Symfony 7.3 with improved performance and modern PHP features - **Testing Infrastructure** - Enhanced test suite with PHPUnit 12 and native lazy object support - **Web Profiler** - Updated debugging and profiling tools for better developer experience ### Fixed - **Configuration Cleanup** - Removed deprecated configurations for Symfony 7.3 compatibility - **Test Configuration** - Modernized PHPUnit configuration with improved test coverage reporting ## v1.1.0 - May 2025 ### Added - **Custom HTTP Status Codes** - Added comprehensive HTTP status code selection for webhook responses, categorized by type (Success, Redirect, Client Error, Server Error) - **Automated Dependency Updates** - Configured Renovate bot for automated dependency management ### Improved - **Code Quality** - Modernized PHP codebase with improved type hints and code organization - **Test Organization** - Enhanced test coverage and organization ### Fixed - **Database Layer** - Upgraded to Doctrine DBAL v4 with improved query performance - **Template Engine** - Updated Twig for better template rendering ### Understanding the Changelog ##### Added New features and capabilities that enhance your webhook testing experience ##### Improved Enhancements to existing features for better performance and usability ##### Fixed Bug fixes and corrections that improve stability and reliability --- --- title: FAQ canonical: https://webhook-box.com/documentation/faq last-modified: 2026-08-23 source: Web Hook Box documentation --- # Frequently Asked Questions Find answers to common questions about Web Hook Box. ## General Questions ### What is Web Hook Box? Web Hook Box is a service that allows you to capture, inspect, test, and forward webhook payloads. It provides a unique URL that you can use to receive webhooks from third-party services, inspect the request details, and optionally forward them to your actual endpoints. ### Is Web Hook Box free to use? Yes, Web Hook Box offers a free tier with basic functionality. We also offer premium features for donors who support the project. Check the pricing page for more details on the differences between free and donor tiers. ### Do I need to create an account? Yes, an account is required to use Web Hook Box. This allows us to provide you with a dedicated dashboard to manage your webhooks, view history, and configure forwarding rules. We use Firebase authentication for secure and easy login. ## Technical Questions ### How do I set up webhook forwarding? To set up forwarding, go to your webhook details page and click on "Configure" in the forwarding section. Enter the destination URL where you want the webhooks to be forwarded and select any additional options like header forwarding or custom responses. ### Can I modify webhooks before forwarding them? Yes, with the webhook transformation feature (available to donors), you can modify the headers, query parameters, and payload before forwarding. This is useful for testing different scenarios or adapting the webhook format to match your endpoint's requirements. ### What happens if my endpoint is down? If your endpoint is unavailable when a webhook is forwarded, Web Hook Box will record the failure and display it in your dashboard. With our retry feature (available to donors), you can configure automatic retries with customizable backoff settings to ensure delivery once your endpoint is back online. ## Data & Security ### How long do you store webhook data? For free accounts, webhook data is stored for 7 days. Donor accounts can access webhook history for up to a month. You can manually delete webhook data at any time from your dashboard. For more details, please refer to our [Security documentation](/documentation/security). ### Is my webhook data encrypted? Yes, all webhook data is encrypted in transit using HTTPS. Additionally, sensitive data stored in our database is encrypted at rest. We follow industry best practices for data security to protect your information. ### Can I use Web Hook Box for sensitive data? While we implement strong security measures, we recommend not using Web Hook Box for highly sensitive data such as personal health information (PHI) or financial data unless you've implemented appropriate data filtering before sending webhooks to our service. For sensitive use cases, consider using our on-premises version. ## Troubleshooting ### I'm not receiving webhooks. What should I check? 1. Verify that you've correctly configured the webhook URL in the sending service 2. Check that your webhook URL is active in your Web Hook Box dashboard 3. Ensure the sending service is actually triggering webhook events 4. Look for any error messages in the sending service's logs or dashboard 5. Test your webhook URL with our built-in testing tool to confirm it's working properly ### My webhooks aren't being forwarded correctly. What's wrong? Check the following: - Verify your forwarding URL is correct and accessible - Check the webhook details page for any forwarding errors - Ensure your endpoint accepts the HTTP method being used - Examine if your endpoint expects specific headers or authentication that might be missing - Use the replay feature to test forwarding with different configurations ### How do I report a bug or request a feature? You can report bugs or request features by creating an issue on our [GitHub repository](https://github.com/webhookbox/web-hook-box). For critical issues, please include steps to reproduce the problem and any relevant webhook IDs or screenshots. Can't find what you're looking for? Check out our [documentation](/documentation) for additional help.