Capturing webhooks

Updated

An endpoint is one named inbox. Give each integration its own endpoint, so each provider has its own capture URL, retention window and redaction settings, and so a URL that leaks affects only that integration.

Create an endpoint

Select New endpoint in the header, enter a name of up to 255 characters, and select Create endpoint. Bobbin opens the endpoint page, which shows the Capture URL:

https://<your-host>/hooks/<public-id>

The public identifier is 32 random hexadecimal characters, generated when the endpoint is created. It cannot be changed, and endpoints cannot be renamed or deleted from the interface. Paste the capture URL wherever the provider asks for a webhook URL.

The endpoint list on Bobbin's home page shows every endpoint with its capture URL, newest first.

What the capture URL accepts

Any HTTP method. POST, PUT, GET and the rest are all stored.
No authentication. Anyone who has the URL can send to it. The unguessable identifier is the only thing protecting it, so treat the URL as a secret.
No signature checks. Bobbin does not verify vendor webhook signatures. It stores signature headers like any other header, so you can check them yourself.

Bobbin stores the request first and only then answers 204 No Content with an empty body. If the identifier does not match an endpoint, the response is 404. Providers that need a specific response body or status to treat a delivery as successful are not supported.

What a capture stores

For each request Bobbin stores:

the HTTP method;
the raw query string, exactly as sent;
every request header and its values, except PHP's internal basic-auth fields;
the body bytes, unparsed;
the time of receipt.

Headers named in the endpoint's redaction list have their values replaced with [redacted by Bobbin] before the capture is written. If body redaction is on, the body is replaced in the same way. Redaction cannot be undone: the original values are never stored. See Configuration.

The Authorization header is stored like any other unless you add it to the redaction list.

Read captures

From the endpoint page, select View captures. The list shows every capture still within the retention window, newest first, with its method, capture number, query string and time of receipt.

Open a capture to see:

Query string, as received.
Headers, one row per value. Headers that were redacted are labelled Redacted before storage, and a note lists which ones.
Body. Text bodies (no content type, any text/ type, or a JSON, XML, JavaScript or form-encoded type, provided the bytes are valid UTF-8) are shown as text. Anything else is shown as Base64; decode it to recover the exact stored bytes. A redacted body is labelled Redacted before storage.
Replay this capture and Delivery history, described in Replaying captures.

Captures cannot be edited or deleted by hand. They are removed when they pass the endpoint's retention window.

Developing without a tunnel

Because a deployed Bobbin is already reachable from the internet, you can point a provider at a capture URL while you build, read what it sends, and replay captures at your application once it is deployed somewhere public. Bobbin only replays to publicly routable addresses, so it cannot deliver straight to localhost or a private network address on a deployed installation.