Webhook tester

One POST with Content-Type application/json and a small JSON body: a fixed source field naming the HyperMonitors webhook tester, the event name webhook.test, a short message and a timestamp. No secrets and nothing about you. You cannot change the method, the headers or the body.

We use the URL only to send this one test, our analytics never record it, and private or internal addresses are refused. Still, a webhook URL often works like a password: anyone who has it can post to it. If yours is meant to stay secret, consider rotating it after testing.

A 401 or 403 usually means the endpoint expects a signature or token the test does not carry, which is normal for signed webhooks. A 404 or 405 points at a wrong path or an endpoint that does not accept POST. A 400 or 422 means it received the request but rejected the test payload, which is fine if it only accepts its own provider's format.