Inspect the whole HTTP request, not only the JSON body.

The layers worth checking

• Method: whether the sender used POST, GET, PATCH or another verb
• Content-Type: whether the body format matches the declared media type
• Headers: signatures, authorization values, user agents and delivery metadata
• Query parameters: callback tokens, event identifiers and routing values
• Raw body: the exact text received before application-specific processing

Why raw bodies matter for signature verification

Some webhook providers calculate signatures from the exact bytes of the request body. Parsing JSON and serializing it again can change whitespace or ordering, which may break verification. Inspecting the raw payload helps confirm whether your application is validating the same bytes the sender signed.

Content-Type mistakes are surprisingly common

A sender may post valid JSON without declaring application/json, or declare JSON while sending malformed text. Inspect both the header and raw body before changing your parser.

Use the inspector as a control group

If the same event appears correctly in SONAR but fails in your application, the problem is probably downstream of delivery. That narrows the search to routing, middleware, verification, parsing, database work or application logic.