Webhook testing strategies in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Webhook Retry Mechanisms

When testing a webhook, why is it important to simulate delayed or failed responses from the receiving server?

A To confirm the webhook sender uses the correct HTTP method

B To verify that the webhook sender retries sending the payload according to the retry policy

C To check if the webhook payload is encrypted during transmission

D To ensure the webhook URL is publicly accessible

💡 Hint

Think about what happens if the receiver is temporarily down or slow.

Simulating delayed or failed responses helps verify that the webhook sender retries sending the payload as expected, ensuring reliable delivery.

❓ Predict Output

intermediate

Webhook Payload Validation Output

Given the following webhook payload validation code snippet, what will be the output if the payload misses the required event_type field?

Rest API

def validate_payload(payload):
    if 'event_type' not in payload:
        return 'Invalid payload: missing event_type'
    return 'Payload valid'

result = validate_payload({'data': 'value'})
print(result)

A Invalid payload: missing event_type

B Payload valid

C KeyError: 'event_type'

D None

💡 Hint

Check what happens when the key is not found in the dictionary.

The function checks if 'event_type' is missing and returns a specific error message instead of raising an exception.

🔧 Debug

advanced

Debugging Webhook Signature Verification Failure

Consider this webhook signature verification snippet. It always returns False even with correct signatures. What is the cause?

Rest API

import hmac
import hashlib

def verify_signature(secret, payload, signature):
    computed = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()
    return computed == signature

# Usage
secret = 'mysecret'
payload = '{"id":123}'
signature = '5d41402abc4b2a76b9719d911017c592'
print(verify_signature(secret, payload, signature))

A Payload should be decoded before hashing

B The secret key is not encoded properly

C The signature is MD5 hash, but code uses SHA256 for verification

D The comparison should use hmac.compare_digest()

💡 Hint

Check the hashing algorithm used for the signature and verification.

The provided signature is an MD5 hash, but the code computes a SHA256 hash, so they never match.

📝 Syntax

advanced

Identify Syntax Error in Webhook Listener Code

Which option contains a syntax error that would prevent a webhook listener from running?

Rest API

from flask import Flask, request
app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook_listener():
    data = request.json
    print('Received:', data)
    return '', 200

A

def webhook_listener():
    data = request.json
    print('Received:', data)
    return '', 200

B

ef webhook_listener():
    data = request.json
    print('Received:', data)
    return '', 200

C

002 ,'' nruter    
)atad ,':devieceR'(tnirp    
nosj.tseuqer = atad    
:)(renetsil_koohbew fed

D

def webhook_listener()
    data = request.json
    print('Received:', data)
    return '', 200

💡 Hint

Look carefully at the function definition line.

Option D is missing a colon at the end of the function definition line, causing a syntax error.

🚀 Application

expert

Determining Number of Valid Webhook Events Processed

A webhook receiver processes a list of events. It only accepts events with type equal to order.created or order.updated. Given the following event list, how many events will be processed?

Rest API

events = [
    {'id': 1, 'type': 'order.created'},
    {'id': 2, 'type': 'order.deleted'},
    {'id': 3, 'type': 'order.updated'},
    {'id': 4, 'type': 'customer.created'},
    {'id': 5, 'type': 'order.created'}
]

processed = [e for e in events if e['type'] in ('order.created', 'order.updated')]
print(len(processed))

A 3

B 2

C 4

D 5

💡 Hint

Count only events with type 'order.created' or 'order.updated'.

Events with id 1, 3, and 5 match the accepted types, so 3 events are processed.