Zintara webhook local testing: verify signatures offline before public delivery

Define the decision

The webhook transport rejects localhost and private addresses. A local fixture test is therefore useful for parser and signature behavior, but it does not test Zintara’s network delivery. Keep those two test layers separate.

Work through the procedure

1. Create synthetic event bodies and a dedicated test secret.
2. Compute the expected HMAC over the exact bytes in your test harness.
3. Test valid, altered and malformed payloads without contacting production.
4. For delivery testing, deploy an approved public HTTPS receiver and use a dedicated endpoint.
5. Inspect receiver persistence and the application test result.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

Offline fixture: reply.received with a fictional lead ID
Positive case: unchanged body and matching signature
Negative case: one body byte changed after signing
Network case: Zintara test.event delivered to the approved HTTPS receiver

Read the result

The offline negative case proves the receiver rejects tampering under the fixture conditions. It does not prove production secret configuration or endpoint reachability, which need the separate delivery test.

Check before moving on

1. Keep test credentials distinct from production.
2. Avoid logging real message contents while debugging.

Limits and next action

Do not expose a development machine or private service through a tunnel without an approved access design. A local HTTP endpoint cannot be pasted directly into this webhook configuration.

Source: Zintara implementation and product context