Free webhook tester: see what a webhook sends before coding

A free webhook tester is a hosted page that gives you a unique public HTTPS URL and shows every request sent to it, with its headers and raw body, so you can see what a webhook sends before you write a receiver. To see Sume's, paste that URL into Send test on the dashboard's Webhooks tab for a signed webhook.test delivery, or pass it as one run's webhook URL to capture a real receipt.

Sume facts come from Webhooks, Run webhooks, Runs and results, and the Sume API reference, read on 2026-09-27. This post names no tester: any service that gives you a public HTTPS URL and shows the raw request works the same way. To send deliveries to code on your own machine instead, see Test Sume webhooks locally with ngrok or a Cloudflare Tunnel.

How do I send a test webhook to a tester URL?

Use Send test: the control on /dashboard/webhooks, or POST /v1/webhooks/test-deliveries with a key carrying account:write. Paste the tester's URL, and Sume POSTs a dummy, signed webhook.test payload to it; it never replays a real job or run. The URL must be public HTTPS; localhost, private-network, and non-HTTPS URLs are rejected. Sume webhook not received? explains the fields the call returns.

curl -X POST https://api.sume.com/v1/webhooks/test-deliveries \
  -H "Authorization: Bearer $SUME_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "webhook_url": "https://example.com/your-tester-url" }'

What will the tester show?

A POST with a JSON body and Sume's signature headers. The test body is small and says outright that it is not a job or run, as the sample below shows; a real delivery carries the same headers, with the run receipt or the job result in payload.

{
  "event": "webhook.test",
  "request_id": "req_wh_test_…",
  "payload": {
    "ok": true,
    "message": "Sume webhook test. Not a job or Format run."
  }
}

How do I capture a real webhook payload?

Create one run or job with the tester's URL as its webhook URL: communication.webhook_url on a Format run, or callback_url on POST /v1/videos. Sume POSTs a run's receipt once, when it completes or fails, and never for a canceled or skipped run. You can't aim an existing run at the tester later, because Redeliver does not send to a different URL.

• A run delivery's payload is the receipt, byte-identical to data from GET /v1/format-runs/{run_id}, so reading the run with your key shows the same object without any tester.
• A receipt over 1 MiB arrives with payload: null and an error that says where to fetch it.

Can I test signature verification in a webhook tester?

Not inside it: a tester doesn't hold your signing secret, and it never should. Use the tester to capture bytes, then run your own verifier on them:

• Copy the raw body byte for byte, not a reformatted view, with the timestamp and signature headers. A re-serialized body does not verify: key order and whitespace are part of what was signed.
• A captured delivery goes stale fast against a five-minute replay window, the default Sume calls reasonable. verifyWebhook from @sume-com/sdk skips the timestamp check when toleranceSeconds is 0; use that only for an offline test.
• A tester's reply only shows what the tester answered. Any 2xx counts as delivered and a 3xx is a failed attempt, so point Send test at your real endpoint before you go live.

Is it safe to send real payloads to a public tester?

Treat anything you send there as public.

• Real receipts carry media.sume.com URLs that don't expire and open for anyone holding them, so capture test content only.
• Any run created with a webhook URL can still POST to it when it reaches a terminal state, so stop using the tester URL when you're done.
• Never paste your API key or signing secret into a tester; Sume's docs keep keys on trusted servers. The fingerprint is the part that is safe to share.