testland/webhook-delivery-tester
Build-an-X for webhook delivery + receiver tests per Standard Webhooks (standardwebhooks.com) - HMAC-SHA256 signature verification, retry semantics with exponential backoff + jitter, replay-window check via timestamp tolerance, ordering guarantees, dead-letter handling for permanent failures, content-type + body-encoding fidelity. Use when authoring tests for webhook senders OR receivers in any system (Stripe / Twilio / SendGrid / GitHub / GitLab outbound webhooks; SaaS app inbound webhooks).
80
100%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Passed
No findings from the security scan
vendor-payloads-and-retries.mdreferences/
Webhook retry schedules and per-vendor payloads
Reference data for webhook-delivery-tester. The core signing, verification,
and replay test code stays in SKILL.md; this file holds the lookup table and
per-vendor specifics that do not need to sit in the workflow spine.
Canonical retry schedule
Per Standard Webhooks, senders retry with exponential backoff plus jitter, capped at N attempts, then dead-letter. A typical delay schedule:
| Attempt | Delay |
|---|---|
| 1 | immediate |
| 2 | 5s |
| 3 | 5min |
| 4 | 30min |
| 5 | 2h |
| 6 | 5h |
| 7 | 10h |
| 8 | (give up; dead-letter) |
Sender retry tests assert the attempt count and the backoff deltas between
attempts (Step 3 in SKILL.md). Dead-letter tests assert that after the max
attempts the webhook is recorded in a dead-letter store and not retried.
Per-vendor sample payloads
For receiver tests of specific vendors, use the vendor's official sample payloads (or captures from their webhook tester), never hand-rolled fixtures - field names drift from real sends.
- Stripe: stripe.com/docs/webhooks -> "Sample events"
- Twilio: twilio.com/docs/usage/webhooks -> per-resource event docs
- SendGrid: docs.sendgrid.com/for-developers/tracking-events
- GitHub: docs.github.com/en/webhooks -> per-event payload reference
- GitLab: docs.gitlab.com/ee/user/project/integrations/webhook_events.html