Inspect, mock, and validate webhooks and API payloads.
Built for backend, integration, and QA engineers. Point your traffic at a Hookline endpoint instead of wiring up another test harness — no ngrok tunnels, no console.log, no Postman collections scattered across three laptops.
INCOMING PAYLOAD
{
"id": "7f2c",
"imp": [{
"id": "1",
"banner": {}
}],
"tmax": 100,
"test": true
}
VALIDATION REPORT
error/imp/0/banner
No w/h and no format[] — size is unresolvable.
warning/tmax
tmax below your 50 ms threshold.
info/cur
Currency absent — USD will be assumed.
Built by engineers who ship integrations.
Customer logos: placeholder — none published yet.
Integration bugs are invisible until they aren't.
You're debugging a webhook you can't see.
The provider says it sent the call. Your logs say nothing arrived. Nobody can show the actual bytes.
The payload is valid JSON but wrong.
Required fields are empty, a size is missing, a consent string is malformed — and you find out in production.
Every integration re-invents the same throwaway setup.
A tunnel, a scratch server, a folder of one-off requests. It works once, then rots.
Instant webhook endpoints
Generate a URL, point traffic at it, and watch requests land live with headers, query, and body.
Inspector and request runner
Replay any captured call, run saved requests against your environments, and search full history.
Mock responses
Reply with any status, body, headers, and delay to see how your handler behaves under each one.
Works with your AI agent via MCP — Claude Code, Cursor, and others can create endpoints and validate payloads for you.
Validation engine
Validation that goes beyond 200 OK.
A payload can be valid JSON and still be wrong. Hookline checks every request against schemas, published specifications, and rules you write yourself — and returns findings with a field path, a severity, and a fix hint.
bid-request.json — 1 error · 2 warnings · 1 info
errorsemantic.imp-banner-size
/imp/0/banner
Banner has neither w/h nor a non-empty format array. Provide banner.w and banner.h, or a format[] with sizes.
warningschain.missing
/source/ext/schain
No supply chain object. Downstream partners may drop the request.
warningsemantic.tmax-low
/tmax
tmax of 100 ms leaves little room for a bid response.
infosemantic.cur-absent
/cur
cur is not set; the default currency will apply.
Schemas and published specs
Validate against your own JSON Schema, or built-in specifications including OpenRTB and TCF/GPP consent — several supported specs, not a single vertical.
Declarative custom rules
Write rules by field path with a severity and a message. No code, no deploy — scope one to a whole document or to every array element.
Structured findings
Every result carries a field path, a severity, and a fix hint, so your team — or your agent — can act on it directly.
How it works
01
Create an endpoint
One click gives you an ingest URL and, if you want, a mock response to reply with.
02
Send traffic to it
Repoint a provider, run a saved request, or let your AI agent fire the call over MCP.
03
Inspect and validate
Read the payload, run it through your validators, and share the record with whoever needs it.
Teams and roles
Owner, admin, editor, and viewer permissions per workspace.
Shareable session links
Send a captured record to a partner without giving them an account.
Encrypted secrets
Environment secrets are stored encrypted and hidden after saving.
SSRF-guarded runs
Outbound requests are checked against internal address ranges before they run.
GDPR-ready
Full request history with configurable retention and deletion.
Pricing
Free
€0
Endpoints, inspector, mock responses, and validation for one workspace. No card required.
Start free
Pro
Contact us
Teams and roles, longer retention, custom rule libraries, and shared session links across workspaces.
Talk to us
Placeholder — paid tiers are not finalised.