---
title: "Test delivery"
method: POST
path: "webhook.test"
tags: ["Webhooks"]
---

# Test delivery

`POST webhook.test` (webhook)

Sent only by POST /api/webhooks/{id}. It cannot be subscribed to.

Every delivery is an HTTP POST with a JSON body `{event, timestamp, data}`. `X-Flyn-Signature` is `t=<timestamp>,v1=<hex>`, where v1 is HMAC-SHA256 keyed with the full webhook secret (including the `whsec_` prefix) over `<t>.<raw request body>`. To verify: split the header on commas, recompute the HMAC over t, a dot and the raw body bytes (not a re-serialised body), compare in constant time, and reject a t (milliseconds) older than your tolerance. Flyn makes one delivery attempt per event with a 10 s timeout (redirects included). A 2xx answer counts as success; a non-2xx answer counts as a failure, and after 10 counted failures in a row the webhook is set inactive. A URL whose host resolves to a private address or fails DNS resolution is not sent to and counts as a failure. Timeouts, connection errors and redirects to a private host are not counted.

## Headers

- `X-Flyn-Signature` string, required
- `X-Flyn-Event` string, required
- `User-Agent` 'Flyn-Webhook/1.0', required

## Payload

- WebhookTestEvent
  - `event` 'webhook.test', required
  - `timestamp` integer, required: Unix time in milliseconds.
  - `data` object, required
    - `message` string, required

## Acknowledgement `200`

Return any 2xx to acknowledge the delivery.

---

[API](https://skmtc.dev/flyn/apis/flyn-api.md) · [All operations](https://skmtc.dev/flyn/apis/flyn-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flyn/apis/flyn-api/revisions/977962a98ccb?raw)