Replay a captured webhook

Your webhook handler threw on a real payload — a field was missing, a type didn't match what you expected, whatever it was. You fix the code. Now you need that exact request again, not a similar one you construct by hand and hope matches. That is what /api/v1/replay is for.

Find the request you want back

curl "https://gethooklab.dev/api/v1/endpoints/k3v9x2m1qa/requests?limit=5" \
  -H "X-API-Key: hkl_your_key_here"
# requestIndex 0 = most recent

Resend it

curl -X POST "https://gethooklab.dev/api/v1/replay" \
  -H "X-API-Key: hkl_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "endpointId": "k3v9x2m1qa",
    "requestIndex": 0,
    "targetUrl": "https://staging.your-app.dev/webhooks/stripe"
  }'

# {
#   "ok": true,
#   "replayed": { "endpointId": "k3v9x2m1qa", "requestIndex": 0, "method": "POST" },
#   "status": 200,
#   "durationMs": 184,
#   "bodyPreview": "{\"received\":true}"
# }

Same method, sanitized headers and body as the original capture, sent to whatever URL you give it, with a 10s timeout. status and bodyPreview in the response are your target's answer — fix, replay, repeat, without touching the provider that sent it the first time.

It will not send to your laptop — and here is why that's deliberate

A replay comes from our servers, not your browser, so it cannot reach localhost or a private network address — 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and their IPv6 equivalents are all rejected outright, and every redirect hop is re-checked so a public URL that bounces to a private one is caught too. This isn't a missing feature: a hosted service that could reach into your local network on request would be a bigger problem than the one it solves.

For a target it can reach — staging, a preview deploy, anything with a public URL — replay works as shown above. For your actual laptop, pair a capture endpoint with a tunnel (ngrok, Cloudflare Tunnel) pointed at your local server, and use replay against staging once the fix is confirmed there.

Need to verify the signature before you replay, so you know the payload is genuinely from the provider and not a stale test? See Stripe or GitHub. Free tier is 1,000 captured requests a month, no credit card — get a key.