Skip to content
Back to tools

Webhook Payload Inspector

Pretty-print, explore and extract values from JSON webhook payloads.

jane@example.com

Tip: click any key in the tree to fill in its path. Supports a.b[0].c, a.b.0.c and a["key-with-dashes"].

Detected fields

  • Looks likeStripe
  • IDevt_1Q2w3E4r5T6y7U8i
  • Event typecheckout.session.completed
  • Timestamp1727430000· 2024-09-27T09:40:00.000Z (Unix seconds)
  • Environmentfalse· Test-mode event
  • IDcs_test_a1B2c3D4e5F6
  • Amount4900· Often in minor units (e.g. cents)
  • IDcus_Qx7Yz8Ab9Cd0
  • Email (PII)jane@example.com
  • ID42
  • URLhttps://example.com/thanks
  • {
    • : "evt_1Q2w3E4r5T6y7U8i"
    • : "event"
    • : "checkout.session.completed"
    • : 1727430000
    • : false
    • : {
      • : {9 keys}
      }
    }

Everything runs in your browser. Payloads are never uploaded, but avoid pasting live secrets anyway.

Working with webhook payloads

A webhook is an HTTP POST that a service sends to your URL when something happens: a payment succeeds, a pull request opens, a form is submitted. The body is almost always JSON, and the first job is usually finding the handful of fields your handler needs in a deeply nested object.

Fields worth finding first

Path syntax

Paths use JavaScript-style access: data.object.id, items[0].sku (or items.0.sku), and headers["content-type"] for keys that aren't valid identifiers. The same paths work in most automation tools and in jq with a leading dot.

Security

Always verify the signature header (Stripe-Signature, X-Hub-Signature-256, X-Slack-Signature, …) server-side against the raw request body before trusting a payload. This inspector is for reading and debugging only. It never sends your data anywhere. If a webhook fires on a schedule, check the timing with the Cron Expression Explainer.

Back to tools