Webhooks

Testing Webhooks

Check an endpoint end to end before real orders depend on it.

Send a test delivery

Send a Test Delivery queues a webhook.test event to the endpoint, signed like any other. A few seconds later, its outcome is in the delivery log.

curl -X POST "https://rassmi.com/api/v1/webhooks/{webhook_id}/test" \
  -H "Authorization: Bearer $RASSMI_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::withToken(env('RASSMI_API_KEY'))
    ->acceptJson()
    ->post('https://rassmi.com/api/v1/webhooks/{webhook_id}/test');

$data = $response->json();

const response = await fetch('https://rassmi.com/api/v1/webhooks/{webhook_id}/test', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.RASSMI_API_KEY}`,
    Accept: 'application/json',
  },
});

const data = await response.json();

import os
import requests

response = requests.request(
    "POST",
    "https://rassmi.com/api/v1/webhooks/{webhook_id}/test",
    headers={"Authorization": f"Bearer {os.environ['RASSMI_API_KEY']}"},
)

data = response.json()

webhook.test

{
    "id": "0199a3d4-2e6f-7c10-b3a5-8d9e0f1a2b3c",
    "event": "webhook.test",
    "timestamp": "2026-10-30T09:31:05+00:00",
    "data": {
        "message": "This is a test delivery from Rassmi.",
        "webhook_id": "0199a3d0-7c41-7b2e-a0f9-3d2c1b0a9e88"
    }
}

Local development

Webhooks need a public address. While developing, expose your local server with a tunnel (Cloudflare Tunnel, ngrok…) and register the tunnel's HTTPS URL; switch it to production with Update Webhook.

Before going live

The signature is checked on the raw body, and a wrong one gets 401.
The endpoint answers 2xx within 3 seconds and queues its work.
A delivery received twice (same X-Rassmi-Delivery) is processed once.
The secret is stored outside your code, and you know how to rotate it.