Skip to main content

Digital Empire › Webhooks › Tester

Webhook tester

Paste your endpoint URL, pick an event, optionally edit the payload, and fire a real signed delivery. Response status + headers + body echoed below.

Every test delivery is signed with the public test secret whsec_test_public_2026_08_ROMEO16 so you can verify signatures with the exact code you plan to ship. Production events use a per-webhook secret returned when you POST to /api/customer/webhooks. Outbound POSTs route through the SSRF-hardened dispatcher; private IPs / metadata endpoints / non-standard ports are refused. Rate limit: 10 / min, 100 / hour per IP.

Only https:// on port 443 (or http:// on port 80). Private IPs and metadata endpoints refused.

Fires when a Chrome-extension scan finishes and its snapshot is written to the store record.

Edit freely. The tester wraps this in the standard envelope ({ id, event, product, occurred_at, data }).

Signed with public test secret whsec_test_public_2026_08_ROMEO16

What the tester sends

Each delivery includes the following headers (identical to production):

The data field of the envelope is exactly what your handler will receive in production. If you want to verify signatures, grab a copy-paste sample for your language and plug in the public test secret above.

Envelope shape

{
  "id": "evt_<ulid>",
  "event": "<event.type>",
  "product": "pixelproof" | "tariffwatch" | "entryproof" | "all",
  "occurred_at": "<ISO 8601>",
  "data": { /* per-event payload */ }
}

Related