AnyHook

Generate a webhook request with a valid signature for Stripe, GitHub, or Slack. If targetUrl is provided, the request is POSTed there and the response is returned.

{
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "enum": [
        "stripe",
        "github",
        "slack"
      ],
      "description": "Webhook provider to simulate."
    },
    "event": {
      "type": "string",
      "description": "Event name (e.g. 'payment_intent.succeeded' for Stripe)."
    },
    "data": {
      "type": "object",
      "additionalProperties": {},
      "description": "Optional fields to deep-merge into the fixture."
    },
    "secret": {
      "type": "string",
      "description": "Signing secret. Falls back to a deterministic default per provider."
    },
    "targetUrl": {
      "type": "string",
      "format": "uri",
      "description": "If set, POST the generated request to this URL and return the response."
    }
  },
  "required": [
    "provider",
    "event"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Verify a webhook signature against a secret. Supports 20 providers including stripe, github, shopify, slack, line, discord, linear, vercel, paddle, hubspot, and paypal.

{
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "description": "Provider name (e.g. 'stripe', 'github', 'slack', 'generic')."
    },
    "headers": {
      "type": "object",
      "additionalProperties": {
        "type": "string"
      },
      "description": "Request headers as a flat object."
    },
    "body": {
      "type": "string",
      "description": "Raw request body."
    },
    "secret": {
      "type": "string",
      "description": "Signing secret to verify against."
    },
    "requestUrl": {
      "type": "string",
      "format": "uri",
      "description": "Original request URL (required for Twilio/HubSpot). Defaults to a placeholder."
    }
  },
  "required": [
    "provider",
    "headers",
    "body",
    "secret"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

List webhook providers AnyHook can mock, along with the event types available for each.

{
  "type": "object",
  "properties": {},
  "$schema": "http://json-schema.org/draft-07/schema#"
}

List apps in your AnyHook account with inbound URLs, sources, and destination URLs. Check isActive: an inactive app's inbound URL answers setup handshakes but acknowledges and discards event POSTs (202, reason app_inactive) instead of relaying them. Destination signing secrets are redacted to has_signing_secret plus a 4-char hint; a new secret in plaintext comes only from rotating it. An app whose slug was changed lists its former URLs under legacyInboundUrls; those still route to it.

{
  "type": "object",
  "properties": {
    "api_key": {
      "type": "string",
      "description": "API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Every AnyHook app is also an email inbox: mail sent to {user}.{app}@anyhook.net becomes an event (type email.received) you can read with anyhook_events. Returns the address and webhook URL for one of your apps.

{
  "type": "object",
  "properties": {
    "api_key": {
      "type": "string",
      "description": "API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio."
    },
    "app": {
      "type": "string",
      "description": "App slug (from anyhook_apps_list). Defaults to your first app."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Create a new app with a name, provider source, and (optionally) destinations. Returns the inbound URL. The app is active immediately. Created WITHOUT destinations it still receives and LOGS every event (inspect-only), it just delivers nowhere until a destination is added (PATCH /api/v1/apps/{slug} with {"destinations": [...]}).

{
  "type": "object",
  "properties": {
    "api_key": {
      "type": "string",
      "description": "API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio."
    },
    "name": {
      "type": "string",
      "description": "Human-readable app name."
    },
    "source": {
      "type": "string",
      "description": "Provider name (stripe, github, shopify, ...). Used for signature auto-detection."
    },
    "destinations": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "url": {
            "type": "string",
            "format": "uri"
          }
        },
        "required": [
          "url"
        ],
        "additionalProperties": false
      },
      "description": "Destination URLs that should receive forwarded events."
    }
  },
  "required": [
    "name",
    "source"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Wire a provider to AnyHook in one call: give a Stripe or GitHub key and AnyHook registers the app's inbound URL as a webhook at the provider, saves the signing secret it yields, and turns on signature verification at the edge. The provider is read from the key; the key is used once and not stored. Without appSlug a new app is created (and removed again if the provider refuses the key). Re-running replaces the registration instead of duplicating it. GitHub sends a signed ping immediately, so the first event appears within seconds. Add a destination afterwards (PATCH /api/v1/apps/{slug}) to forward events; until then they are received and logged.

{
  "type": "object",
  "properties": {
    "api_key": {
      "type": "string",
      "description": "API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio."
    },
    "provider_key": {
      "type": "string",
      "description": "A Stripe secret or restricted key (sk_… / rk_…) or a GitHub token (github_pat_… / ghp_…). The provider is read from the key. Used once to register the webhook at the provider; AnyHook does not store it. Least privilege: a Stripe restricted key with Webhook Endpoints = Write, or a fine-grained GitHub token with Webhooks = Read and write."
    },
    "appSlug": {
      "type": "string",
      "description": "Connect this existing app. Omit to create a new app for the provider."
    },
    "target": {
      "type": "string",
      "description": "GitHub only: \"owner/repo\", or an organization name for an org-wide hook. Optional when the token administers exactly one repository."
    }
  },
  "required": [
    "provider_key"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Re-send a stored event to its destinations. Replays sit outside the monthly event quota but within a daily replay limit per plan, and replaying an event that was held for quota bills it as a new event. The destination does run its handler again: a receiver that is not idempotent will process the event twice while debugging.

{
  "type": "object",
  "properties": {
    "api_key": {
      "type": "string",
      "description": "API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio."
    },
    "id": {
      "type": "string",
      "description": "Event ID to replay. Replay does not consume event quota."
    }
  },
  "required": [
    "id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Show events for the given app that have not successfully reached any destination (failed or still retrying).

{
  "type": "object",
  "properties": {
    "api_key": {
      "type": "string",
      "description": "API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio."
    },
    "appSlug": {
      "type": "string"
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    }
  },
  "required": [
    "appSlug"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Re-send every failed event for the given app slug. Useful after fixing a downstream bug to recover queued work.

{
  "type": "object",
  "properties": {
    "api_key": {
      "type": "string",
      "description": "API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio."
    },
    "appSlug": {
      "type": "string",
      "description": "Bulk-replay every failed event for this app."
    }
  },
  "required": [
    "appSlug"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

List webhook events, most recent first: id, app, type, status, attempt, destination status code, latency, timestamp. Summaries only, no request headers or body — call anyhook_inspect with an id from here to read one event's payload. Uses your AnyHook account when connected, otherwise the local in-memory store.

{
  "type": "object",
  "properties": {
    "api_key": {
      "type": "string",
      "description": "API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio."
    },
    "appSlug": {
      "type": "string",
      "description": "Filter to a specific app slug (account mode)."
    },
    "source": {
      "type": "string",
      "description": "Filter by provider source (local mode)."
    },
    "status": {
      "type": "string",
      "description": "Filter by status. Account mode: queued|success|retrying|failed. Local mode: received|forwarded|failed|retrying."
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Full detail for one event by id, including the inbound headers and body that anyhook_events omits, plus the destination's response. Payloads can be large and often contain personal data, so fetch one at a time, only when the body is needed. Account or local store.

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Event ID returned by anyhook_events."
    },
    "api_key": {
      "type": "string",
      "description": "API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio."
    }
  },
  "required": [
    "id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}