Webhooks
Manage endpoints, inspect every delivery attempt, resend a failed delivery, or send a one-off connectivity test.
The Konsole Webhooks section covers endpoints, event history, and delivery attempts. It's where you go after a "modify → redeploy → cross fingers" webhook fix, to confirm it actually worked.
Not a payload editor
This section was previously documented as a "Webhook Tester" that could replay a real event or let you craft and edit a custom simulated payload. Neither exists as an editor. There are exactly two ways to send a webhook outside of real traffic, both described below, and neither lets you change the body before sending.
Resend a real delivery (unmodified)
From Webhooks → Deliveries, click Retry on any delivery (or select several and use
Retry bulk, capped at 100 per batch). This re-dispatches the exact original stored
payload — attempt count, event type, and body are unchanged — with a freshly computed
X-Wajub-Signature (new timestamp, new HMAC). There is no field to alter the body, headers, or
target URL before resending.
/webhooks/wajub50010021msattempt 1/webhooks/wajub500240msattempt 2/webhooks/wajub200142msretried ✓Retries are metered against your plan's max_webhooks monthly quota.
Send a connectivity test (fixed payload)
From Webhooks → Endpoints, each endpoint has a Test action. It sends one hardcoded
payload — type: "webhook.test", a fixed data block — signed the same way as a real delivery.
It is not configurable and does not simulate any real event type (there is no way to make
it send a synthetic payment.succeeded or transfer.failed, for example). Use it only to confirm
your endpoint is reachable and returns 2xx.
Inspect each attempt
For every real delivery and every test send, the record shows:
HTTP status coderesponseoptionalResponse bodyresponseoptionalDurationresponseoptionalAttempt numberrequestoptionalStatusrequestoptionalVerify your signature locally
If your endpoint returns 400 on real deliveries, compare against the signature
scheme in signature verification — the header is
X-Wajub-Signature: v1={hmac}, where the HMAC input is
{timestamp}.{raw_json_body}, not the raw body alone. Nine times out of ten a
400 means the timestamp prefix was dropped, or the raw body was re-serialized by a JSON
middleware before verification.