Inspect one synthetic webhook before paying for an event pipeline
Make the event contract, captured request and duplicate-handling questions visible with four ongoing-free tools.
A small webhook review pack: one synthetic event, a field contract, a captured-request receipt, duplicate and malformed cases, and a named production gap.
It uses synthetic data only and does not connect a real commerce account, implement a production handler or claim an executed test. The visual is an editorial illustration, not a provider screenshot or customer result.
About this guide & its examples
This original FreeStack workflow plans a fictional cafe order event. Official sources checked 4 November 2026.
Illustrations are FreeStack concepts, not provider screenshots. Check the free limits below and test your own files before delivery.
Free boundaries before you start
What’s free, whether you need an account, and when we last checked.
Hookdeck Inspect · checked 2026-11-04
Ongoing free webhook testing without an account. Captured requests: 3-day retention; browser session: fixed 90 days, while Source URLs keep working afterwards. UI shows latest 250 requests; older retained requests are available through API pagination. Source creation: 60/minute; reads: 60/minute per client IP and Source URL. Ingestion has separate platform limits. Proprietary hosted service under Hookdeck terms. Source URLs are link-accessible, not private: anyone with the ID can read and manage captured data. Use synthetic payloads, never production traffic. Mock samples do not carry your signing secret; verification support varies by platform.
No account is required for the documented Inspect route. Save Data uses a free Hookdeck account for cross-device Source URL sync.
Bruno · checked 2026-11-04
The $0 Open Source tier is ongoing free, separate from the 14-day Ultimate trial. Current comparison: two workspaces, unlimited collection-runner use and five OpenAPI syncs per month. Paid GitUI, reporting, governance and other premium features must not be assumed included. Local files, device storage and any API service used have separate limits.
The pricing page does not establish all account requirements. Do not infer that every integration or premium feature works without an account.
Visual Studio Code · checked 2026-11-04
VS Code remains free for private and commercial use. Microsoft's distribution uses its product licence; the published source is MIT-licensed. Extensions, Settings Sync, Copilot, remote services and deployment infrastructure have separate terms and limits.
No Microsoft account is required for core local editing. Optional sync, Copilot, marketplace or hosted services can require accounts.
Git · checked 2026-11-04
Free GPLv2 distributed version-control software for local repositories, with no provider project or history quota. Remote hosting, backup, access control and large-file storage are separate services.
No account is required for a local Git repository. Any remote host or sync service can require an account.
A small example to aim for
order.updated · demo-001
See the shape.
Name the trust boundary.
Field contract · fictional fixture · capture receipt · duplicate case · production gap
FreeStack editorial illustration · not an executed request, Hookdeck screenshot or customer result.
Illustrative example · adapt it to your project.
Jump to a step
Define the event before choosing the pipeline
Write a small contract for a fictional order.updated event: event_id, event_type, occurred_at and data.status. Use an invented event ID such as demo-001 and no names, addresses, payment details or credentials. Name required fields, allowed status values and the expected handling of an unknown event type. Keep the first outcome to an inspectable request; delivery guarantees and production processing are separate requirements.
Keep the fixture portable and unchanged
Create fixtures/order-updated.json and review.md in a local folder. Record the exact fixture version with Git before sending it. Keep expected behaviour separate from observations: an expectation is not a passed test. Exclude real endpoint IDs, captured customer data, keys and local environment files from history. Git records a revision; independent backup and access control remain separate.
Send one synthetic request to a test Source URL
Create a Hookdeck Inspect Source URL and use Bruno to send the fixture as an HTTP POST with Content-Type application/json. Use the ingest URL for sending and the inspect URL for reading; the official API treats them separately. Keep the source link out of public notes: anyone holding its ID can read and manage captured data. Use only test traffic. Record the response you actually receive, or mark this step not run.
Inspect the body without confusing capture with trust
Compare the captured headers and body with the fixture and contract. Note required fields, casing, content type and any unexpected transformation. A successful capture does not establish sender identity or durable processing. Hookdeck's representative sample events contain synthetic identifiers and are not signed with your secret. Signature support varies by source type; the current Stripe and Shopify Inspect setup has no signing-secret field and does not verify signatures.
Write the cases a production handler must survive
Prepare a second fixture with the same event_id, one with a missing required field and one with an older occurred_at value. Use separate Bruno requests if you choose to send them. Record observed captures separately from the planned handler decision: deduplicate by the agreed event identity, reject or quarantine malformed events and define the ordering policy. Inspecting duplicates does not implement idempotency, a queue, retries or authentication. Mark every unexecuted case as planned.
Save the evidence and name the paid requirement
Keep a redacted receipt containing the fixture revision, expected fields, actual observations, unresolved cases and review date. Do not archive a live Source URL as a secret substitute. Inspect currently limits Source creation to 60 requests per minute and reads to 60 per minute per client IP and Source URL; ingestion has separate platform limits. FreeStack editorial upgrade triggers: private authenticated endpoints, retention beyond three days, managed retries and queues, production rate controls or governed team access. Pay only when one of those requirements is explicit.
Your workflow, connected.
Follow the steps and carry the output into the next stage. These are suggested handoffs, not automatic integrations.
- 02Own the fixture
VS Code core editing is free for private and commercial use. Git is GPLv2 software with no provider history quota. Remote hosting and AI extensions are separate.
Named revision + expected behaviour - 03Send safely
Inspect is free without an account; request retention is three days. Bruno's $0 Open Source tier lists two workspaces, unlimited collection-runner use and five OpenAPI syncs per month. Premium trial features are outside this kit.
Request definition + actual response - 04Separate the claims
The browser shows the latest 250 captured requests; older requests can be paged through the API within retention. Source links remain usable after the fixed 90-day browser session expires.
Field comparison + trust boundary
Provider information
Check current plans and documentation before committing to a workflow.
A couple of useful questions
Do I need an account?
Hookdeck Inspect documents a no-account route. Its Save Data option uses a free Hookdeck account to sync Source URLs. VS Code and local Git do not require provider accounts for the core workflow. Bruno's pricing page does not establish every account requirement, so none is assumed here.
How long does the free evidence remain available?
Captured requests are retained for three days. The browser session lasts a fixed 90 days; Source URLs keep working afterwards. The UI shows 250 recent requests and the API can paginate older retained ones. Keep your own redacted review notes rather than treating Inspect as backup.
Does this verify a provider signature?
No. This guide sends a fictional JSON fixture. Some Inspect source types can verify a configured signing secret; others, including the documented Stripe and Shopify setup, do not. Real verification must be designed for the chosen provider and handler.
What does Save this toolkit keep?
It uses the existing FreeStack flow to save the four catalogue tools. Sign in for private account storage; guest saves stay in that browser. It does not store payloads, create endpoints, run requests or buy a provider membership.
What would you try?
Share your result or ask a specific question about this workflow.
Join the conversation