Smoke-Test Your Webhooks Subscriptions

Prerequisites Checklist

Before you start, confirm these three items:

Step 1 — Get a Test URL from webhook.site

webhook.site hands you a unique URL and logs every incoming request — headers and body — with no signup or local listener required. It is the fastest way to confirm delivery before pointing a subscription at real infrastructure.

1. Open webhook.site in a new browser tab.
   Go to https://webhook.site. The page generates a unique URL for you automatically — no account needed.
2. Copy "Your unique URL."
   It looks like https://webhook.site/d3cb1088-6609-4284-8d11-.... Keep this tab open — incoming requests will appear in the left-hand list as soon as they arrive.

Step 2 — Register a Webhook Subscription

1. Open the Tools ribbon → Integration dropdown → Webhooks API.
   In the top ribbon, click the Tools tab. In the Integration panel, click the Integration dropdown and choose Webhooks API.
2. Select event type project.created, paste the webhook.site URL, and add the subscription.
   Choose project.created from the Event type dropdown. Paste the URL you copied from webhook.site into Target URL. Leave Auto-generate checked for the secret. Click Add Subscription.
3. Copy the secret immediately.
   It is shown once, in a highlighted panel. Copy it now — you'll use it in Step 4 to verify the signature. Standard Time® never displays it again; the list shows *** from now on.

Step 3 — Trigger an Event and Verify Delivery

1. Save a new project in Standard Time®.
   Any name works — this is just to fire the project.created event you subscribed to.
2. Switch to the webhook.site tab.
   Within a few seconds, a new entry should appear at the top of the left-hand request list.
3. Click the new entry and inspect it.
   The right-hand pane shows the request headers — including x-st-webhook-signature — and the raw JSON body, which should contain "event": "project.created" along with the project's fields (ProjectID, ProjectName, and the rest).

Step 4 — Verify the HMAC Signature

The x-st-webhook-signature header is an HMAC-SHA256 digest of the raw request body, computed with the secret you copied in Step 2. Recomputing it yourself confirms your receiving endpoint can trust the source of incoming requests.

# Paste the secret from Step 2 and the raw body from webhook.site
$key   = [System.Text.Encoding]::UTF8.GetBytes("PASTE_YOUR_SECRET_HERE")
$msg   = [System.Text.Encoding]::UTF8.GetBytes('PASTE_RAW_BODY_HERE')
$hmac  = New-Object System.Security.Cryptography.HMACSHA256 @(,$key)
$hash  = $hmac.ComputeHash($msg)
"sha256=" + (($hash | ForEach-Object { $_.ToString("x2") }) -join "")

Run this in PowerShell and compare the output to the x-st-webhook-signature value shown on webhook.site — they should match exactly.

Step 5 — Test the Delete Event and the Test Button

Two more checks confirm the subscription behaves correctly under the two other event lifecycles it will see in production.

1. Click the row's Test button in the Webhook Subscriptions dialog.
   This fires a sample payload to webhook.site immediately, without waiting for a real record change — useful for confirming your production endpoint is reachable at any time, not just when a real event happens to occur.
2. Delete the project you created in Step 3.
   If you also registered a project.deleted subscription, a third request should arrive on webhook.site with a minimal body: { "event": "project.deleted", "id": "..." } — no other fields, since the record no longer exists to query.

Step 6 — Clean Up and Confirm the Feed Stops

1. Delete the test subscription from the dialog.
   Click Delete next to the project.created row.
2. Save another project.
   Confirm no further requests arrive on webhook.site. This proves the subscription — not something else — was the source of the earlier traffic, and that deleting it fully stops delivery.

Troubleshooting

Nothing ever arrives on webhook.site

The signature doesn't match

Request arrives but the body looks wrong

Test button shows an error status

Next Steps — All Webhook & Integration Guides

Your webhook delivery is confirmed. From here you can register subscriptions for any of the 11 record types, wire them into your own infrastructure or an automation platform, and move on to Standard Time®'s other integrations.