---
title: "Test Alert Webhook"
method: POST
path: "/api/v2/alert-webhooks/{alert_webhook_id}/test"
tags: ["Alerts", "Enterprise"]
---

# Test Alert Webhook

`POST /api/v2/alert-webhooks/{alert_webhook_id}/test`

Synchronously dispatches a mock payload for the given `event_type` to the
webhook's target URL using the current HMAC secret. No `alert_attempts`
row is persisted. The handler returns `200` for both successful and failed
upstream deliveries; the `status_code` and `error` fields in the response
body surface the upstream outcome.

## Request body

- object — Request body for dispatching a mock payload to an alert webhook.
  - `event_type` string, required — The alert event type to mock in the dispatched payload. The server builds a representative payload for the given type using the webhook's current HMAC secret.
  - `version` integer, required — Payload data version for the supplied `event_type`. Must be one of the data versions advertised for that type by `GET /api/v2/alert-event-types`.

## Response `200`

OK

- object
  - `data` object — Result of dispatching a mock payload to an alert webhook. The handler returns this body with a `200` status code on both successful and failed upstream deliveries; the `status_code` and `error` fields surface the upstream outcome.
    - `status_code` integer, nullable — HTTP status code returned by the webhook target.
    - `error` string, nullable

## Other responses

- `400` — **Bad Request** This could be due to one of the following reasons: - JSON payload is missing or malformed - Path or query parameters are missing or invalid/malformed - The data sent is not valid (ex- sending a `string` in an `integer` field)
- `401` — **Unauthorized** This endpoint failed an authentication requirement. Either the client tried to access a protected endpoint without being authenticated, or an auth validation failed (ex- invalid credentials or expired token).
- `403` — **Forbidden** This is most commonly caused by an authenticated client trying to access a resource that it does not have permission for.
- `404` — **Not Found** This error typically comes from operations where a valid ID was passed to the request to look up an entity but the entity could not be found.
- `429` — **Too Many Requests** The client has sent too many requests within a certain time window and tripped the rate limiting middleware.
- `500` — **Internal Server Error** This is usually the result of either an unexpected database or application error. The client may try modifying or resending the request, but the error is likely not related to the client doing something wrong.

## Changes

- **2026-08-25** `e34679d9b779` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/specterops/apis/bloodhound-api/changes/api/v2/alert-webhooks/:alert_webhook_id/test/post.md)

---

[API](https://skmtc.dev/specterops/apis/bloodhound-api.md) · [All operations](https://skmtc.dev/specterops/apis/bloodhound-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/specterops/bloodhound-api/revisions/6d4b33f1714e/schema)