The request is delivered exactly like a real one: HTTPS POST, Content-Type: application/json, the same {"event": {...}, "sourcetype": "..."} envelope, and your token sent as entered in the auth_header header. Use it to confirm authentication, body parsing, index or sourcetype routing, and any parsing of the MongoDB Extended JSON fields.

• Event type: by default the test matches the webhook's current mode: a hudsonrock:data event when data_alert is true, otherwise a hudsonrock:alert event. Pass type to test the other format.
• Test marker: every test event carries "test": true inside event. Real events never include this field, so you can drop test events from production rules and playbooks.
• Content: test events contain placeholder data only. Summary alerts list the company's monitored domains with zero counts. Data alerts contain one anonymized employee record built around the company's first domain, with TEST- placeholder values for secrets.
• Unsaved configuration: pass webhook in the body to test a URL, token and header before saving them. Otherwise the company's stored webhook is used; if there is none, 409 Conflict is returned.
• Result: the response reports whether your endpoint returned a 2xx (delivered), the HTTP status, the response time, the first 1 KB of the response body, and the exact payload we sent. A rejected or unreachable endpoint still returns 200 from this API, with delivered: false.
• Limits: the test makes one attempt with a 10-second timeout and doesn't follow redirects. Destinations that resolve to private, loopback or link-local addresses are refused. You can send one test per company every 10 seconds; more frequent calls return 429.If the authenticated user belongs to an organization with synced_data: true, only the user with organization.role: "owner" can call this endpoint. Other members receive 403 Forbidden.