Webhook monitoring

Watching the requests arriving at your app.

Uptime checks prove your server answered. They cannot prove that Stripe called it. This is the other direction.

How it works

Create an endpoint on the Webhooks page and you get a unique URL:

https://saasfoundry.app/i/8f2b91c4a70d5e6b3a1f2c8d

Paste it into Stripe, GitHub, Shopify — anything that sends webhooks. Every request that arrives is captured in full: method, headers, body, query string, source IP, size and exact arrival time. Try it now:

curl -X POST https://saasfoundry.app/i/YOUR_TOKEN   -H 'Content-Type: application/json'   -d '{"event": "hello"}'

The URL always answers 200 quickly, so a sender never sees a failure and never disables the endpoint.

Signature verification

Paste your signing secret and pick a scheme — Stripe, GitHub, Shopify, or generic HMAC-SHA256. Every request is checked and labelled. Comparisons are constant-time, a missing or malformed header counts as invalid, and there is no fail-open path.

Invalid requests are still captured — you need to see attacks and misconfigurations — but they are never forwarded to your app.

Forwarding with retries

Turn on forwarding and we deliver each captured request to your own URL: the exact original bytes, the original headers minus hop-by-hop ones, plus X-SaaSFoundry-Event-Id and X-SaaSFoundry-Endpoint. Signature headers pass through, so your own verification still works.

Anything that is not a 2xx retries with backoff:

attempt 1  immediately
attempt 2  + 30 seconds
attempt 3  + 2 minutes
attempt 4  + 10 minutes
attempt 5  + 1 hour
attempt 6+ + 6 hours

Pending retries live in the database, not in memory, so a deploy in the middle of a backoff window loses nothing.

Silence alerts

The important one. Set a silence alert on an endpoint that should be busy, and we tell you when nothing has arrived for N minutes. That is the outage nobody else notices: payments still succeed, your database never hears about them.

Replay

Fix the bug, press Replay, and the exact original bytes are sent again. No asking a provider to re-trigger an event.