WebhookLab
Dashboard

WebhookLab documentation

API, MCP, and Safety Model

WebhookLab provides webhook simulation, transient signature utilities, redacted discovery, contract validation, and trace-aware delivery evidence for PlatPhorm News.

OpenAPI JSONCapabilities harnessMCP descriptor

Local signature APIs

These routes are safe for discovery, demo validation, and redacted reads without credentials.

  • GET /api/health
  • GET /api/capabilities
  • GET /api/docs
  • GET /api/openapi.json
  • GET /api/mcp
  • POST /api/mcp read-only tools
  • POST /api/v1/signatures/generate
  • POST /api/v1/signatures/verify
  • GET /api/v1/agent compatibility action catalog
  • GET /llms.txt
  • GET /sitemap.xml
  • GET /.well-known/platphorm.json

Simulator safety

The workbench is designed for repeatable local testing with honest evidence.

  • Secrets are accepted only for the current request.
  • Secrets are never returned or added to browser history.
  • Sensitive delivery evidence is redacted before display.
  • Unavailable integrations return a degraded state.

Capabilities

Webhook Simulation

working

Generate webhook event payloads and run public-safe local simulations without persistent delivery.

Availability: interactive

Signature Generation

working

Generate HMAC signatures for test webhook payloads without persisting raw secrets.

Availability: interactive

Signature Verification

working

Verify webhook signatures against payloads and timestamp tolerance without persisting raw secrets.

Availability: interactive

Endpoint Registration

working

Register webhook receiver endpoints with SSRF-safe URL validation.

Availability: service-backed

Event Creation and Listing

working

Create persistent webhook events with protected dispatch; public reads are redacted.

Availability: interactive

Delivery Tracking

working

Inspect webhook delivery and attempt state with public-safe redaction.

Availability: interactive

Delivery Replay

working

Replay webhook deliveries with protected authorization and explicit operator confirmation.

Availability: service-backed

Contract Creation

working

Create and manage persistent webhook contracts.

Availability: service-backed

Payload Validation

working

Validate webhook payloads against known contracts or demo schemas.

Availability: interactive

Vercel Webhook Receiver

working

Receive Vercel webhook events and verify configured Vercel signatures.

Availability: service-backed

MCP Integration

working

Expose webhook tools, resources, and prompts through JSON-RPC MCP.

Availability: interactive

Agent Endpoint

working

Expose safe agent actions with protected mutations gated by PLATPHORM_API_KEY.

Availability: interactive

Docs and OpenAPI

working

Publish human API docs and parseable OpenAPI metadata for public and protected routes.

Availability: interactive

llms, Sitemap, Robots, Feed

working

Expose public-safe discovery files for agents and crawlers.

Availability: interactive

Signature Handling

Signature generation and verification are stateless. Raw secrets are accepted only in JSON request bodies, never persisted, never returned, and never included in evidence. Operators provide a transient local secret at runtime.

curl is not required. Use Node fetch or platphormctl:

const localOnlySecret = getSecretFromOperatorInput();

fetch("https://webhooklab.platphormnews.com/api/v1/signatures/generate", {
  method: "POST",
  headers: {"content-type": "application/json"},
  body: JSON.stringify({
    payload: { id: "evt_demo", type: "webhook.test" },
    secret: localOnlySecret,
    algorithm: "sha256"
  })
})

Trust Policy

Web dashboard, public-safe discovery, browser-based operations, trusted-domain discovery, standard route compliance, Vercel metadata capture, trace inspection, and agentic workflow discovery are intentionally supported for public read-only debugging and operator workflows. Mutating, administrative, ingestion, replay, fork, remediation, deployment, sync, test-triggering, reporting, and write actions require PLATPHORM_API_KEY.

Agent Handoff

npx @platphormnews/platphormctl site inspect https://webhooklab.platphormnews.com --json --trace
npx @platphormnews/platphormctl site routes https://webhooklab.platphormnews.com --json --trace
npx @platphormnews/platphormctl site openapi https://webhooklab.platphormnews.com --json --trace
npx @platphormnews/platphormctl site llms https://webhooklab.platphormnews.com --json --trace
npx @platphormnews/platphormctl site sitemap https://webhooklab.platphormnews.com --json --trace
npx @platphormnews/platphormctl mcp initialize https://webhooklab.platphormnews.com/api/mcp --json --trace
npx @platphormnews/platphormctl mcp tools https://webhooklab.platphormnews.com/api/mcp --json --trace
npx @platphormnews/platphormctl --include webhooklab.platphormnews.com network validate --best-effort --evidence --json --trace