Create a new webhook.site endpoint. Returns the unique token/URL for the webhook.

Create a new webhook.site endpoint with custom configuration (response content, status, timeout, CORS, alias).

Send a POST request with JSON data to a webhook.site endpoint.

Get all requests that have been sent to a webhook.site endpoint.

Search requests sent to a webhook with query filters (method, content, headers, date range, type).

Get the most recent request sent to a webhook.site endpoint.

Get detailed information about a webhook (settings, expiry, stats).

Update webhook settings (response content, status code, timeout, CORS).

Delete a webhook.site endpoint and all its data.

Delete a specific request from a webhook.

Delete all requests from a webhook, optionally filtered by date range or query.

Get the full URL for a webhook token. Optionally validate that the token exists.

Get the unique email address for a webhook token. Any emails sent to this address will be captured by the webhook. Optionally validate that the token exists.

Get the unique DNSHook domain for a webhook token. Any DNS lookups to this domain (or subdomains) will be captured. Useful for bypassing firewalls or as canary tokens. Optionally validate that the token exists.

Wait for a new HTTP request to be received by the webhook. Uses real-time streaming (SSE) to efficiently wait without polling. Useful for testing webhooks, callbacks, and API integrations.

Wait for an email to be received at the webhook's email address ({token}@email.webhook.site). Uses real-time streaming (SSE) to efficiently wait. Automatically extracts links from the email, including magic/auth links for login flows.

Generate SSRF (Server-Side Request Forgery) test payloads for bug bounty testing. Creates unique identifiable URLs that can be injected into targets to detect blind SSRF vulnerabilities.

Quick check if any OOB (Out-of-Band) callbacks have been received. Useful for bug bounty to verify if SSRF, XXE, or blind injection payloads were triggered.

Generate XSS (Cross-Site Scripting) callback payloads for bug bounty testing. Creates JavaScript payloads that ping your webhook when executed, useful for detecting blind XSS.

Generate canary tokens for detecting unauthorized access or data leakage. Creates trackable URLs that alert you when accessed.

Extract and analyze all URLs/links from a captured request. Useful for finding password reset links, verification tokens, and other sensitive URLs.

Send multiple requests to a webhook in batch. Useful for load testing or sending multiple test payloads at once.

Export all captured requests from a webhook to JSON format. Includes full request details: headers, body, IP, timestamp, user agent.