Webhook Ingestion

Receive, store, and replay inbound webhooks from any service. Every event is preserved with full headers and payload for inspection.

Ingestion URL

Each project has a unique webhook ingestion endpoint. Send HTTP POST requests from any external service:

POST https://tracevium.com/ingest/webhook/:org_slug/:project_key

Find your org_slug and project_key on the project settings page. Tracevium accepts any content type and stores the raw body and all headers verbatim.

What gets stored

• Full request body — raw payload exactly as sent (JSON, form-encoded, XML, etc.).
• All headers — including Content-Type, User-Agent, and custom headers.
• Event type — extracted from X-Event-Type or equivalent headers when present.
• Source IP — originating IP address of the sender.
• Received timestamp — exact UTC time the event arrived.
• Signature status — whether the payload signature was verified.

Signature verification

To ensure events are genuinely from the expected source, Tracevium supports HMAC-SHA256 signature verification. The expected signature header:

X-Signature-256: sha256=<hmac-sha256-hex-digest>

The digest is computed as HMAC-SHA256(signing_secret, raw_body). Events with an invalid or missing signature are stored but flagged as unverified.

Rotating the signing secret

If a signing secret is ever exposed, rotate it immediately from Project Settings. Update the secret in your webhook sender's configuration — events received with the old secret will be flagged unverified until updated.

Replaying events

Any stored event can be replayed — Tracevium resends the original payload (headers + body) to a destination URL you specify. Replay is useful when:

• An integration failed to process an event the first time.
• You are testing a new integration with real production payloads.
• An event arrived during a deployment window and needs reprocessing.

Event type extraction

Tracevium extracts an event type using the following header priority:

1. 1X-Event-Type
2. 2X-GitHub-Event
3. 3X-Gitlab-Event
4. 4type field from JSON body
5. 5Falls back to unknown if none match.

Retention

Webhook events are retained for a rolling 90-day period. Export or replay critical events before they age out.