Webhook Payload Inspector
Paste a raw webhook request — optional HTTP headers plus a JSON or form-encoded body — and get a structured breakdown: parsed headers, a pretty-printed and validated body, detected content-type and size, the sending provider and event type, extracted timestamps, and flagged signature headers (X-Hub-Signature-256, Stripe-Signature, X-GitHub-Event…). Runs entirely in your browser.
Input
Output
Overview
| Property | Value |
|---|---|
| No data yet | |
Request Headers
| Header | Value |
|---|---|
| No data yet | |
Signature & Provider Headers
| Header | Value | Meaning |
|---|---|---|
| No data yet | ||
Timestamps
| Field | Raw Value | UTC |
|---|---|---|
| No data yet | ||
Formatted Body
Guides
Debugging a webhook is awkward: the request arrives at your server as one opaque blob of headers and a body, and by the time you notice something is wrong the request is gone. The Webhook Payload Inspector lets you paste a captured request — the headers, the body, or both — and immediately see it broken apart into readable pieces, without sending anything anywhere.
What it does
Paste a raw webhook request and the inspector produces:
- Overview — the detected format (JSON, form-urlencoded, or plain text), the content-type, the body size in bytes, the character count, JSON depth and total key count, the sending provider and event type, and how many timestamps were found.
- Request headers — every header line parsed into a clean name/value table, with folded (multi-line) headers reassembled.
- Signature & provider headers — the security- and provenance-relevant headers pulled out and explained:
X-Hub-Signature-256,Stripe-Signature,X-GitHub-Event,X-Shopify-Hmac-Sha256,X-Slack-Signature,Svix-Signature,X-Gitlab-Token, PayPal transmission headers, and more. This tells you at a glance which secret and which algorithm a request expects to be verified against. - Timestamps — any field that looks like a timestamp (Unix seconds, Unix milliseconds, or ISO 8601) is converted to a human-readable UTC time, so
1709312520stops being a mystery. - Formatted body — the body pretty-printed and validated. Malformed JSON does not break the tool; it is reported as a parse error with the exact position so you can find the stray comma.
How to use it
- Copy a webhook request from your logs, your provider's dashboard, or a tool like a request-bin.
- Paste it into the input box. You can include the HTTP request line and headers (everything above the blank line) or paste just the JSON body on its own.
- Read the tables. The tool auto-detects whether it is looking at a full request or a bare body — a payload starting with
{or[is treated as a body with no headers.
Provider detection
Even without headers, the inspector recognizes the payload shapes of GitHub, Stripe, Shopify, Slack, Discord, Twilio, and SendGrid, and reports the event type it can infer. When headers are present they take priority, since a header like X-GitHub-Event: push is more reliable than guessing from the JSON.
Does this verify the signature?
No. This is an inspection tool — it flags which signature header is present and what algorithm it uses, but it never computes an HMAC or checks a secret. Nothing is sent to the provider.
Is my data private?
Yes. All parsing happens in your browser. Payloads and headers frequently contain secrets, tokens, and signatures, so the tool never puts your input into shareable links.
Use it from code
From 3 credits per callREST API
curl -X POST https://api.iotools.cloud/v1/tool/webhook-payload-inspector \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"payload": "POST /webhook HTTP/1.1\nHost: example.com\nContent…"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `webhook-payload-inspector` tool (Webhook Payload Inspector) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.