---
title: "Webhook test delivery"
method: POST
path: "board.test"
tags: ["Board Watches"]
---

# Webhook test delivery

`POST board.test` (webhook)

Sent by `POST /watches/{watchId}/test`, signed and authenticated exactly like a real delivery. Headers: `Content-Type: application/json`, `X-Vaquill-Event: board.test`.

**Verification.** Present only when the watch has a `webhookSecret`. Prefer the Standard Webhooks headers: `webhook-id`, `webhook-timestamp` (Unix seconds) and `webhook-signature` (`v1,<base64>`, several space separated while a secret rotates), an HMAC-SHA256 over `{webhook-id}.{webhook-timestamp}.{raw body}`. The HMAC key is the base64 decoding of the secret after `whsec_` when it has that prefix, otherwise the secret's UTF-8 bytes. Verify against the raw bytes before parsing, and reject a timestamp more than 5 minutes old. `webhook-id` is stable across retries of one delivery. The legacy `X-Vaquill-Signature: sha256=<hex>` header (HMAC-SHA256 of the raw body) is also sent, is deprecated, and remains for at least 12 months. Respond with any 2xx to acknowledge; redirects are not followed.

## Payload

- BoardTestWebhookPayload: Body of a `board.test` delivery, sent by `POST /watches/{watchId}/test`.
  - `event` 'board.test', required
  - `firedAt` string, required: ISO 8601 time the delivery was built.
  - `corpusType` string, required
  - `state` string, nullable
  - `boardLabel` string, required
  - `test` true, required: Always true: marks the delivery as a manual test.

## Acknowledgement `204`

Acknowledge with any 2xx status.

---

[API](https://skmtc.dev/vaquill/apis/vaquill-developer-api.md) - [All operations](https://skmtc.dev/vaquill/apis/vaquill-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vaquill/apis/vaquill-developer-api/revisions/fbac9b87775e?raw)