A simulated webhook dispatcher. Register a subscription, trigger an event, and inspect delivery attempts (~70% simulated success rate), retries, and payload-signature verification. Signatures here are a simplified simulated scheme for testing your verification logic — not real HMAC-SHA256.
The Webhooks API is the receiving end of the problem: register a callback URL, trigger an event, then inspect exactly what was delivered and replay it. Deliveries are signed with an HMAC, so you can practise verifying a signature — including the constant-time comparison and the replay window that separate a real verifier from a string equality check.
Base URL: https://funapi.dev/api/webhooks/v1 · 7 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.
who gets notified, and for what
POST /webhooks/v1/subscriptions — Register a webhook subscription (requires Bearer auth) · Responds with 201 400 401 Link to this endpointGET /webhooks/v1/subscriptions — List webhook subscriptions (secrets redacted) (requires Bearer auth) · Responds with 200 Link to this endpointDELETE /webhooks/v1/subscriptions/{id} — Unsubscribe (requires Bearer auth) · Responds with 204 401 403 404 Link to this endpointattempts, replays, and signature checks
POST /webhooks/v1/trigger — Fire an event to all matching subscriptions (~70% simulated success) (requires Bearer auth) · Responds with 200 201 400 Link to this endpointGET /webhooks/v1/deliveries — List delivery attempts, filter by status or subscription (requires Bearer auth) · Responds with 200 400 Link to this endpointPOST /webhooks/v1/deliveries/{id}/replay — Replay a delivery attempt (409 after 3 attempts) (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpointPOST /webhooks/v1/verify-signature — Verify a payload signature (simulated scheme, not real HMAC) · Responds with 200 400 Link to this endpointLast updated