A webhook test sends a synthetic ping. It checks the receiver path without representing a signed waiver or an arrival. Your handler should recognize that difference before any downstream business action is allowed to run.
Prepare the receiver’s verification path
Capture the raw request body and apply the current signature-verification procedure before trusting the payload. Use the endpoint’s secret from the secure storage where you saved it at creation or rotation. Do not place the secret in a public example, browser bundle or request log.
The verification guide covers raw bytes, timestamp checks and signature comparison. A test is useful only if it exercises the same verification path as normal deliveries.
Request the synthetic delivery
Use webhooks:manage:
POST /v1/webhooks/{id}/test
Authorization: Bearer YOUR_API_KEY
The test endpoint returns a deliveryId and is limited to 10 calls per minute per key. The ping is sent regardless of the endpoint’s subscribed business events. It is not a normal event name to add to the subscription array.
Keep ping processing harmless
After verification, handle the event type explicitly. An illustrative dispatch policy is:
verified ping -> acknowledge receiver test
verified supported business event -> enqueue durable business work
unknown event -> record minimal diagnostic context and apply explicit policy
invalid signature -> reject without business work
Do not route every verified envelope into a handler that assumes data contains a waiver ID. A ping can validate the transport while legitimately having no participant action to perform.
Inspect delivery and worker results separately
Use the delivery identifier and the documented delivery-list route to investigate the test. A successful receiver response establishes the HTTP outcome, not the correctness of a separate background worker or booking integration.
Then exercise a controlled business workflow and verify its downstream result. Test invalid signatures, malformed bodies and repeated deliveries as separate receiver cases. Avoid sending test mutations to production participant records merely to make a dashboard turn green.
Record what was verified: endpoint reachability, signature handling, acknowledgment and business processing are separate checks. That record is useful during a later URL or secret change and prevents a synthetic ping from being presented as proof of the entire integration.