Introduction
WebhookVault captures every webhook sent to your endpoints, keeps it, and lets you inspect, search, replay and forward it — from the dashboard or entirely over the API.
WebhookVault gives every webhook a durable home. Point a sender at a capture URL and the vault stores the request — headers, body, source, timing — answers the sender whatever you configured, and optionally relays it onward with retries and a full per-attempt delivery history. Nothing is silently dropped: when something can't be stored in full or delivered, that fact is recorded where you can see it.
Everything the dashboard does, the REST API does too — including things a dashboard can't, like blocking until an expected webhook arrives in a CI job.
Choose your path
Capture your first webhook
A capture URL in one call, a stored request seconds later. The five-minute path.
Test webhooks in CI
Ephemeral endpoints + the await API: assert that a webhook actually fired, in one HTTP call.
Forward and replay
Relay captures onward with retries, dead-lettering, and re-delivery of anything, any time.
API reference
Every endpoint, with schemas, examples and a live playground.
What you can do
| Area | Capability |
|---|---|
| Capture | Any method, any content type, binary included. The endpoint answers senders with the status, headers and body you configure. |
| Inspect | Search stored requests by method, delivery state, time window and text; read any of them in full, forever within your retention window. |
| Forward | Relay captures to your own URL in the background — retries with backoff, dead-letter parking, per-attempt history. |
| Replay | Re-deliver any stored request — one at a time, or hundreds queued in bulk. |
| CI mode | Create self-expiring endpoints from a pipeline and block until a matching webhook arrives. |
Principles
- The vault never lies. A
200from a capture URL means the request is stored. A request that exceeded your payload cap is stored as an oversize trace, marked as such — never a fake payload. - Errors are contracts. Every non-2xx API response is an RFC 9457 problem with a stable machine
code. Parse the code; show the detail. See Errors. - Limits are visible. Rate limits answer
429withRetry-After; plan caps explain themselves in the response instead of failing mysteriously. See Rate limits.
Where next?
- Quickstart — first webhook captured in five minutes
- Concepts — endpoints, captured requests, deliveries
- Authentication — API keys and how to treat them