Webhook replay: safely resend a captured event

What a replay sends

• The stored request method and body.
• Stored headers except Host, Content-Length, Connection, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto.
• An outbound request with a 30-second timeout.

Replay safety

Signature implications

Replays preserve stored signature headers. Time-bound provider signatures, including Stripe signatures, can fail application-side verification during replay because Hookmetry does not re-sign a request.

When to replay

• Reproduce a parsing or routing failure against a controlled target.
• Verify that a fixed handler accepts the same payload shape.
• Compare the target response before and after an application change.
• Test idempotency by sending the same event more than once in a non-production environment.

Replay procedure

1. Inspect the original event and identify its side effects, credentials, and personal data.
2. Choose a staging or otherwise approved target URL.
3. Confirm the target is idempotent and safe for a repeated event.
4. Send the replay and review its recorded response status, duration, and error.
5. Correlate the replay with target application logs and verify the resulting state.

Replay versus provider redelivery