HTTP debugging

A request bin for the requests you cannot see anywhere else.

Use SONAR as a temporary request bin when you need a public URL that shows exactly what another system sent. It is designed for integration debugging, webhook development and API experiments.

Request bin vs application logs

Application logs tell you what your code decided to log. A request bin shows what reached an independent endpoint before your framework, middleware, schema validation or business logic can alter it. That makes it useful for identifying missing headers, wrong content types, unexpected field names and encoding problems.

Good situations for a temporary request bin

  • Checking whether a webhook provider is sending events at all
  • Comparing documentation with the actual payload
  • Inspecting signature and authorization headers
  • Testing query parameters from third-party callbacks
  • Sharing a reproducible request shape with another developer

What not to put into a request bin

Do not treat a temporary bin as durable storage. Keep production credentials, personal data and sensitive customer records out of debugging payloads. Use synthetic examples and provider test modes instead.

Start with one reproducible request

A useful debugging habit is to capture one known event first, understand its exact shape, and only then compare failing events. This removes a large amount of noise from integration debugging.

Frequently asked

Questions developers ask

What is a request bin?

A request bin is a temporary HTTP endpoint that records incoming requests so developers can inspect them.

Is a request bin the same as a webhook tester?

They overlap heavily. A webhook tester is a request bin optimized for event-driven callbacks and webhook debugging.

Can I inspect headers?

Yes. SONAR records request headers alongside the body and query parameters.

Editorial standard

Built for practical debugging

This guide is written to help developers reproduce and isolate webhook failures. Examples use synthetic data, and production security guidance should always be checked against the official documentation for the provider you integrate.

Last reviewed: September 2026.