---
title: "Test Webhook Endpoint"
method: POST
path: "/api/webhooks/test"
tags: ["webhooks"]
---

# Test Webhook Endpoint

`POST /api/webhooks/test`

## Request

- Base URL: `https://zsign.io` (the document declares no server; this is the origin it was published from)
- URL: `https://zsign.io/api/webhooks/test`
- Auth: HTTP bearer

Test webhook endpoint connectivity.

With no body the test targets the org's saved singleton config — that is
what the dashboard's "Test Webhook" button exercises. A `url` in the body
overrides it (testing a not-yet-saved endpoint); when a config exists the
event is still signed with its secret, so a receiver enforcing signature
verification passes the test exactly as it would a real delivery.

Authenticated, and the target URL is SSRF-guarded (must resolve to a
public address) before any request is made — otherwise the server could be
coerced into probing internal/metadata endpoints.

## Request body

- WebhookTestRequest
  - `url` string, uri, nullable

## Response `200`

Successful Response

- WebhookTestResponse
  - `success` boolean, required
  - `response_time` integer, required
  - `status_code` integer, nullable
  - `error` string, nullable
  - `event_id` string, nullable
  - `response_body` string, nullable
  - `response_headers` object, nullable
  - `request` WebhookTestSentRequest: The exact request we POSTed, echoed so the caller can replay it (e.g. "Copy as cURL" in settings) or compare it against what their receiver logged. Contains the signature header but never the secret — the signature is what was transmitted, not credential material.
    - `url` string, required
    - `headers` object, required
    - `body` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/zsign/apis/zsign-api.md) · [All operations](https://skmtc.dev/zsign/apis/zsign-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zsign/apis/zsign-api/revisions/a674ac4137ba?raw)