Set the boundary first
This workflow is for a webhook you are authorized to test. Choose a staging receiver or disposable local target and create a synthetic event with invented identifiers. Keep production signing secrets, access tokens, session cookies, customer records, and personal data out of the capture session. Decide retention and replay approval before the first request.
Capture before forwarding
Use webhook-debugger-relay to create a unique receive URL and bounded session. Inspect method, headers, body, and signature behavior before forwarding. Configure only a disposable test secret and the documented test header when signatures matter. Replay one sanitized case to the approved target with automatic forwarding disabled during investigation.
Check transport separately
Run ssl-checker against the receiver hostname and record DNS resolution, certificate identity, validity dates, chain details, and protocol findings. This is transport evidence, not proof of application ownership, route authorization, or correct event processing.
Close with layered evidence
Separate capture facts, signature observations, replay results, certificate findings, and application evidence. Mark the case passed, failed, or needing review only against the agreed threshold, then delete temporary data or document approved retention. For broader request reproduction use api-request-replay-and-debugging; for schema and response compatibility use api-contract-testing.