Webhooks

Webhook Payload Examples

Realistic, shortened sample payloads for popular webhook providers, with the headers they send and the fields worth reading. Use them to build and test handlers before the first real event arrives.

  • Free
  • No sign-up
  • Runs in your browser

Stripe · payment_intent.succeeded

Headers 
Content-Type: application/json; charset=utf-8
Stripe-Signature: t=1760000000,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd
User-Agent: Stripe/1.0 (+https://stripe.com/docs/webhooks)
Key fields
  • type names the event. Route on it, and ignore types you don’t handle.
  • data.object is the full object at the time of the event, here a PaymentIntent.
  • id (evt_…) is unique per event. Store it and skip events you’ve already processed, because Stripe can deliver an event more than once.
  • livemode is false for test-mode events, which are signed with a different secret.
Body (application/json) 
{
  "id": "evt_3PqR8s2eZvKYlo2C1a9XyZ0b",
  "object": "event",
  "api_version": "2024-06-20",
  "created": 1760000000,
  "data": {
    "object": {
      "id": "pi_3PqR8s2eZvKYlo2C1rM6kT4d",
      "object": "payment_intent",
      "amount": 4900,
      "amount_received": 4900,
      "currency": "usd",
      "customer": "cus_QhX2mQ7bLr9TzA",
      "metadata": { "order_id": "1042" },
      "status": "succeeded"
    }
  },
  "livemode": false,
  "pending_webhooks": 1,
  "request": {
    "id": "req_8kX2bQ1mZ3pLwe",
    "idempotency_key": "b1f7c2d4-6e0a-4c1b-9f3e-2a7d5c8e1b90"
  },
  "type": "payment_intent.succeeded"
}
Send it to a local server 
curl -X POST http://localhost:8000/webhook \
  -H 'Content-Type: application/json' \
  --data '{"id":"evt_3PqR8s2eZvKYlo2C1a9XyZ0b","object":"event","api_version":"2024-06-20","created":1760000000,"data":{"object":{"id":"pi_3PqR8s2eZvKYlo2C1rM6kT4d","object":"payment_intent","amount":4900,"amount_received":4900,"currency":"usd","customer":"cus_QhX2mQ7bLr9TzA","metadata":{"order_id":"1042"},"status":"succeeded"}},"livemode":false,"pending_webhooks":1,"request":{"id":"req_8kX2bQ1mZ3pLwe","idempotency_key":"b1f7c2d4-6e0a-4c1b-9f3e-2a7d5c8e1b90"},"type":"payment_intent.succeeded"}'

GitHub · push

Headers 
Content-Type: application/json
User-Agent: GitHub-Hookshot/044aadd
X-GitHub-Event: push
X-GitHub-Delivery: 72d3162e-cc78-11e3-81ab-4c9367dc0958
X-Hub-Signature-256: sha256=d57c68ca6f92289e6987922ff26938930f6e66a2d161ef06abdf1859230aa23c
Key fields
  • The event name is only in the X-GitHub-Event header; the body has no type field.
  • X-GitHub-Delivery is unique per delivery; use it to detect duplicates.
  • ref is the full reference, such as refs/heads/main. Strip refs/heads/ to get the branch name.
  • GitHub sends a ping event when you create the webhook, so handle it with a 2xx response.
Body (application/json) 
{
  "ref": "refs/heads/main",
  "before": "6113728f27ae82c7b1a177c8d03f9e96e0adf246",
  "after": "59b20b8d5c6ff8d09518454d4dd8b7b30f095ab5",
  "repository": {
    "id": 1296269,
    "name": "octo-repo",
    "full_name": "octo-org/octo-repo",
    "private": false,
    "default_branch": "main"
  },
  "pusher": { "name": "octocat", "email": "octocat@example.com" },
  "sender": { "login": "octocat", "id": 583231, "type": "User" },
  "commits": [
    {
      "id": "59b20b8d5c6ff8d09518454d4dd8b7b30f095ab5",
      "message": "Fix retry backoff for failed deliveries",
      "timestamp": "2026-09-14T10:21:07+00:00",
      "author": { "name": "The Octocat", "email": "octocat@example.com" },
      "added": [],
      "removed": [],
      "modified": ["src/retry.js"]
    }
  ],
  "head_commit": {
    "id": "59b20b8d5c6ff8d09518454d4dd8b7b30f095ab5",
    "message": "Fix retry backoff for failed deliveries"
  }
}
Send it to a local server 
curl -X POST http://localhost:8000/webhook \
  -H 'Content-Type: application/json' \
  --data '{"ref":"refs/heads/main","before":"6113728f27ae82c7b1a177c8d03f9e96e0adf246","after":"59b20b8d5c6ff8d09518454d4dd8b7b30f095ab5","repository":{"id":1296269,"name":"octo-repo","full_name":"octo-org/octo-repo","private":false,"default_branch":"main"},"pusher":{"name":"octocat","email":"octocat@example.com"},"sender":{"login":"octocat","id":583231,"type":"User"},"commits":[{"id":"59b20b8d5c6ff8d09518454d4dd8b7b30f095ab5","message":"Fix retry backoff for failed deliveries","timestamp":"2026-09-14T10:21:07+00:00","author":{"name":"The Octocat","email":"octocat@example.com"},"added":[],"removed":[],"modified":["src/retry.js"]}],"head_commit":{"id":"59b20b8d5c6ff8d09518454d4dd8b7b30f095ab5","message":"Fix retry backoff for failed deliveries"}}'

Shopify · orders/create

Headers 
Content-Type: application/json
X-Shopify-Topic: orders/create
X-Shopify-Hmac-Sha256: XWmrwMey6OsLMeiZKwP4FppHH3cmAiiJJAweH5Jo4bM=
X-Shopify-Shop-Domain: example-shop.myshopify.com
X-Shopify-API-Version: 2024-07
X-Shopify-Webhook-Id: b54557e4-bdd9-4b37-8a5f-bf7d70bcd043
Key fields
  • X-Shopify-Topic names the event; X-Shopify-Shop-Domain tells you which store sent it.
  • Prices are strings such as "199.00". Parse them as decimals, not floats.
  • IDs are larger than JavaScript can represent exactly, so JSON.parse rounds them. Keep IDs as strings, or use admin_graphql_api_id.
  • The HMAC header is Base64, computed over the raw body with your app’s client secret.
Body (application/json) 
{
  "id": 820982911946154508,
  "admin_graphql_api_id": "gid://shopify/Order/820982911946154508",
  "email": "jon@example.com",
  "created_at": "2026-09-14T10:21:07-04:00",
  "currency": "USD",
  "total_price": "199.00",
  "subtotal_price": "189.00",
  "financial_status": "paid",
  "fulfillment_status": null,
  "order_number": 1042,
  "customer": {
    "id": 115310627314723954,
    "email": "jon@example.com",
    "first_name": "Jon",
    "last_name": "Snow"
  },
  "line_items": [
    {
      "id": 866550311766439020,
      "product_id": 632910392,
      "title": "Monitoring hoodie",
      "quantity": 1,
      "price": "189.00",
      "sku": "HOODIE-M"
    }
  ]
}
Send it to a local server 
curl -X POST http://localhost:8000/webhook \
  -H 'Content-Type: application/json' \
  --data '{"id":820982911946154508,"admin_graphql_api_id":"gid://shopify/Order/820982911946154508","email":"jon@example.com","created_at":"2026-09-14T10:21:07-04:00","currency":"USD","total_price":"199.00","subtotal_price":"189.00","financial_status":"paid","fulfillment_status":null,"order_number":1042,"customer":{"id":115310627314723954,"email":"jon@example.com","first_name":"Jon","last_name":"Snow"},"line_items":[{"id":866550311766439020,"product_id":632910392,"title":"Monitoring hoodie","quantity":1,"price":"189.00","sku":"HOODIE-M"}]}'

Slack · app_mention (Events API)

Headers 
Content-Type: application/json
X-Slack-Request-Timestamp: 1760000000
X-Slack-Signature: v0=a2114d57b48eac39b9ad189dd8316235a7b4a8d21a10bd27519666489c69b503
Key fields
  • When you first set the Request URL, Slack sends type url_verification with a challenge value that you must return in the response.
  • Respond within 3 seconds. Slack retries slow or failed requests and adds X-Slack-Retry-Num and X-Slack-Retry-Reason headers.
  • event.type is the event you subscribed to; event_id is unique per event.
  • The token field is deprecated. Verify requests with the signing secret instead.
Body (application/json) 
{
  "token": "Jhj5dZrVaK7ZwHHjRyZWjbDl",
  "team_id": "T0001",
  "api_app_id": "A0KRD7HC3",
  "event": {
    "type": "app_mention",
    "user": "U061F7AUR",
    "text": "<@U0LAN0Z89> is the nightly backup done?",
    "ts": "1760000000.000200",
    "channel": "C0LAN2Q65",
    "event_ts": "1760000000.000200"
  },
  "type": "event_callback",
  "event_id": "Ev0LAN670R",
  "event_time": 1760000000
}
Send it to a local server 
curl -X POST http://localhost:8000/webhook \
  -H 'Content-Type: application/json' \
  --data '{"token":"Jhj5dZrVaK7ZwHHjRyZWjbDl","team_id":"T0001","api_app_id":"A0KRD7HC3","event":{"type":"app_mention","user":"U061F7AUR","text":"<@U0LAN0Z89> is the nightly backup done?","ts":"1760000000.000200","channel":"C0LAN2Q65","event_ts":"1760000000.000200"},"type":"event_callback","event_id":"Ev0LAN670R","event_time":1760000000}'

Twilio · SMS status callback

Headers 
Content-Type: application/x-www-form-urlencoded
X-Twilio-Signature: 0/KCTR6DLpKmkAf8muzZqo1nDgQ=
Key fields
  • This is a form post, not JSON. Read the fields as form parameters.
  • MessageStatus moves through queued, sent and delivered, or ends as undelivered or failed. Callbacks can arrive out of order.
  • X-Twilio-Signature is a Base64 HMAC-SHA1 of the full callback URL followed by the sorted form parameters, so it can’t be checked against the body alone.
  • Use MessageSid to match the callback to the message you sent.
Body (application/x-www-form-urlencoded) 
MessageSid=SM1f0e8ae6ade43cb3c0ce4525424e404f&MessageStatus=delivered&AccountSid=AC00000000000000000000000000000000&From=%2B15017122661&To=%2B15558675310&ApiVersion=2010-04-01&SmsSid=SM1f0e8ae6ade43cb3c0ce4525424e404f&SmsStatus=delivered
Send it to a local server 
curl -X POST http://localhost:8000/webhook \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'MessageSid=SM1f0e8ae6ade43cb3c0ce4525424e404f&MessageStatus=delivered&AccountSid=AC00000000000000000000000000000000&From=%2B15017122661&To=%2B15558675310&ApiVersion=2010-04-01&SmsSid=SM1f0e8ae6ade43cb3c0ce4525424e404f&SmsStatus=delivered'

Zapier · Webhooks by Zapier (POST action)

Headers 
Content-Type: application/json
X-Webhook-Secret: set-your-own-secret
Key fields
  • Zapier sends exactly the fields you map in the action, so the shape is up to you.
  • There is no built-in signature. Add your own secret header, as shown here, and check it on your server.
  • Nested keys in the action (lead__email) are sent as nested JSON objects.
  • Zapier can also receive webhooks with a Catch Hook trigger. Send this payload to that URL to test a Zap.
Body (application/json) 
{
  "event": "new_lead",
  "lead": {
    "name": "Ada Lovelace",
    "email": "ada@example.com",
    "source": "Typeform"
  },
  "zap_id": "123456789",
  "sent_at": "2026-09-14T10:21:07Z"
}
Send it to a local server 
curl -X POST http://localhost:8000/webhook \
  -H 'Content-Type: application/json' \
  --data '{"event":"new_lead","lead":{"name":"Ada Lovelace","email":"ada@example.com","source":"Typeform"},"zap_id":"123456789","sent_at":"2026-09-14T10:21:07Z"}'

How to use the Webhook Payload Examples

  1. Choose a provider tab.
  2. Read the headers and the notes on key fields.
  3. Copy the payload into your tests, or send it to the webhook tester with curl.
  4. Confirm the details against the provider’s documentation for your API version.

Catch webhooks that never arrive

SensaCat tracks each step of a business flow (payment, order, fulfilment) and alerts you when an expected event doesn’t show up in time.

Start monitoring free

Frequently asked questions

They follow each provider’s documented structure, but they are shortened and use made-up IDs. Exact fields vary by API version and event type, so treat them as a starting point.

Save the JSON to a file and run curl -X POST -H "Content-Type: application/json" --data @payload.json http://localhost:8000/webhook. Signature checks will fail unless you also send a matching signature.

Twilio status callbacks are sent as application/x-www-form-urlencoded form posts, so read them as form fields instead of parsing JSON.

Verify the signature, store or queue the event, and return a 2xx response quickly. Do slow work in the background: providers time out long requests and retry them, which creates duplicates.

Related tools

Webhook Tester

Get a temporary URL and inspect the headers and body of every webhook sent to it.

Uses our server Open tool

Webhook Signature Verifier

Check an HMAC webhook signature for Stripe, GitHub, Shopify, Slack or your own scheme.

Runs in your browser Open tool

JSON Formatter

Pretty-print, minify and validate JSON with exact line and column errors.

Runs in your browser Open tool

See all free tools →