Request Inspector (Webhook Tester)

Create a temporary webhook endpoint and watch every HTTP request that hits it arrive live in your browser. It records the method, path, query string, headers, client IP and body of each request — JSON and text are pretty-printed, multipart form data is split into fields and files, and uploaded or raw images are shown as thumbnails. Endpoints accept any method with open CORS and are deleted, along with everything captured, after 1 hour.

How to use

  1. Click Create endpoint to get a unique, temporary URL that is valid for 1 hour.
  2. Point your webhook, app or script at that URL, or copy one of the ready-made curl and fetch examples.
  3. Watch requests appear in the list as they arrive; click one to see its headers, query, body, form fields and files.
  4. Click Clear to delete the endpoint and its data early, or New endpoint to start over.

Example

Input

curl -X POST "https://api.quto.dev/hook/<id>/orders?src=test" \
  -F "file=@photo.jpg" -F "caption=Hello"

Output

Response: 200 {"ok":true,"id":"…"}
POST /orders?src=test  ·  multipart/form-data
Form fields: caption = Hello
Files: photo.jpg (image/jpeg) — thumbnail + download

Frequently asked questions

How long does an endpoint last?

Each endpoint expires 1 hour after it is created. When it expires, the endpoint and every captured request and file are deleted from the server. You can also delete it immediately with Clear.

Which requests can I send?

Any HTTP method — GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS — to the endpoint URL or any sub-path below it. Bodies can be JSON, text, URL-encoded or multipart form data, or raw binary such as an image. Requests are limited to 10 MB, files to 5 MB each, and each endpoint accepts up to 60 requests per minute and 200 in total.

Can I call the endpoint from a web page?

Yes. The endpoint answers with open CORS headers and records preflight OPTIONS requests too, so browser code using fetch or XMLHttpRequest works from any origin.

Is it safe to send real data?

Avoid it. Anyone who knows the endpoint URL can send data to it, and although only your browser holds the key to view captured requests, this is a testing tool. Authorization and Cookie headers are masked, but use test credentials and sample data.

Related tools