Skip to content

Centrali Play: test webhook delivery

Centrali Play is an open-source, disposable webhook capture API, hosted at https://play.centrali.io. Create a temporary destination without an account, send HTTP requests to it, and retrieve captured events as JSON. It works with any webhook sender; a Centrali workspace is optional.

Play is API only. Use curl or build your own viewer.

1. Create a session

curl -X POST https://play.centrali.io/sessions

Save the returned id, captureUrl, readToken, and expiresAt. Creation returns HTTP 201. The capture URL permits writes; the separate read token permits reads. Credentials are returned once.

2. Send a test request

Replace <captureUrl> with the value returned above:

curl -i -X POST '<captureUrl>' \
  -H 'Content-Type: application/json' \
  --data '{"example":"hello"}'

Successful capture returns HTTP 204. You can also set the capture URL as the destination in your webhook sender. For Centrali outbound webhooks, use it as a test subscription destination and trigger a matching event.

3. Read the captured events

Replace the session ID and read token with the values returned by creation:

curl 'https://play.centrali.io/sessions/<session-id>/events?after=0-0' \
  -H 'Authorization: Bearer <read-token>'

The response includes events, nextCursor, hasMore, cursorBehindRetention, and expiresAt. Event bodies use base64 encoding. Each page contains up to 10 events within a 256 KiB response bound. Use nextCursor as the next after value; follow hasMore to read additional pages. See the event response contract for the full schema.

When there are no more events, poll no faster than every five seconds and back off to 10, 20, then 30 seconds after empty responses. Honor Retry-After on 429 and 503 responses. Stop at expiry or a 404; do not automatically create replacement sessions.

Limits and data handling

  • Sessions expire after one hour by default. Reads and writes do not extend the deadline.
  • Bodies are limited to 64 KiB; only the latest 50 events are retained per session.
  • Shared capacity and rate limits can temporarily reject requests. A successful health check does not guarantee session capacity.
  • Missing or malformed read credentials return 401. Expired sessions and incorrect well-formed credentials return 404.
  • Use synthetic data. Common credential headers are redacted, but bodies are not scrubbed for secrets or personal information. Keep capture URLs and read tokens private.

Run your own instance

Play is MIT licensed and can run with Node or Docker. See the source repository and self-hosting guide.

For signed outbound delivery, retries, and delivery history in your application, continue to Outbound Webhooks.