webhook.test
Sent by POST /api/v1/webhooks/{id}/test. Carries no message.
Signed with Standard Webhooks. At-least-once and unordered. Payloads are at most 64 KB. Answer any 2xx within 10 seconds; anything else is retried on the published curve.
webhook-id*stringThe delivery id. Identical across retries — dedupe on it.
webhook-timestamp*stringUnix seconds. Reject anything more than 5 minutes from now (replay protection).
webhook-signature*stringSpace-separated v1,<base64 HMAC-SHA256> signatures of {webhook-id}.{webhook-timestamp}.{raw body}, keyed with the base64 part of your whsec_ secret. Two appear during a secret rotation's grace window; accept either. Verify against the RAW body, before parsing.
application/json- body
Sent by POST /api/v1/webhooks/{id}/test. Carries no message.
id*stringThe delivery id — also sent as webhook-id. Dedupe on it.
type*"webhook.test""webhook.test"version*"1""1"created_at*stringWhen we queued it.
date-timeoccurred_at*stringWhen it happened. Order on this, never on arrival.
date-timedata*Accepted. Any 2xx stops retries.
Sent by POST /api/v1/webhooks/{id}/test. Carries no message.
{ "id": "string", "type": "webhook.test", "version": "1", "created_at": "2019-08-24T14:15:22Z", "occurred_at": "2019-08-24T14:15:22Z", "data": { "event_id": "string", "message": null, "detail": {} }}{ "webhook-id": "string", "webhook-timestamp": "string", "webhook-signature": "string"}