Run webhook tests in CI - DevHelm

Give each run its own inbox, store the API token as a CI secret, and delete the inbox before the job exits. A shared inbox mixes events from parallel jobs. Create an API key under Settings → API Keys and save it as DEVHELM_API_TOKEN. An API key is already scoped to one organization and workspace. See Authentication.

One inbox per run

export DEVHELM_API_TOKEN=dh_live_xxxxxxxx
devhelm inboxes create --name ci-run -o json
devhelm inboxes wait <inbox-id> --timeout-ms 30000 -o json
devhelm inboxes delete <inbox-id> --yes

Use a distinct --name per run. Read id and httpUrl from the create JSON. Point the system under test at httpUrl, start the wait, then trigger the send. --yes skips the delete prompt so the job can finish unattended. Delete runs even when the wait fails. A later job should not keep reading the previous run’s events.

TypeScript in the job

import { Devhelm } from "@devhelm/sdk";

const client = new Devhelm({
  token: process.env.DEVHELM_API_TOKEN!,
});

const inbox = await client.inboxes.create({ name: "ci-run" });
try {
  const event = await client.inboxes.wait(inbox.id, { timeoutMs: 30_000 });
  console.log(event.id, event.method, event.path, event.text());
} finally {
  await client.inboxes.delete(inbox.id);
}

inboxes.create returns the inbox, including id and httpUrl. Give httpUrl to the sender, then call wait.

Next steps

Assert in a test

Match method and path, and read the body.

Simulate failures

Reply with 500 or a delay from the same inbox.