Skip to main content
Every input option you pass to Webhook Debugger & Logger controls a specific aspect of how the actor captures, secures, transforms, or responds to incoming webhook traffic. This page documents all available fields drawn from the actor’s input schema, organized by functional group. You can set these values in the Apify Console input tab, pass them as JSON via the INPUT environment variable, or supply them through the Apify API.

Endpoint setup

Configure how many webhook URLs are generated and how long they stay active.
​
integer
default:"3"
Number of unique webhook endpoints to generate for this run. Accepts a value between 1 and 50. Each endpoint gets its own ID and captures traffic independently.
​
integer
default:"24"
How long generated webhook URLs remain active, in hours. Accepts 1 to 168 (one week). After expiry, the endpoint immediately stops accepting traffic and its logs are removed from /logs during the next cleanup cycle (up to 10 minutes later).
Reducing retentionHours via hot-reload only affects newly generated webhooks. Pre-existing webhooks keep their original expiry window. Events already written to the Apify Dataset are not affected.
Protect the actor from traffic spikes and control how incoming payloads are handled.
​
integer
default:"10485760"
Maximum allowed size for an incoming request body, in bytes. Accepts 1024 to 104857600 (100 MB). Requests that exceed this limit are rejected with 413 Request Entity Too Large. The default is 10 MB (10485760).
​
boolean
default:"true"
When enabled, the actor automatically parses application/json request bodies into structured dataset objects, making payload fields searchable and filterable through the /logs API.
​
integer
default:"60"
Maximum requests per minute allowed on management endpoints (/logs, /info, /replay, and similar routes). The limit is applied per client IP. Accepts 1 to 1000.
Control who can send traffic to your endpoints and how sensitive data is handled.
​
boolean
default:"true"
When enabled, the actor automatically redacts Authorization, Cookie, and Set-Cookie headers from stored logs. Enable this when you are capturing traffic from real providers to avoid persisting credentials.
​
array
A list of dot-notation paths inside the JSON body to redact before storage. All paths must start with body. — for example, body.token, body.user.password, or body.payment.card. Redacted values are replaced with a placeholder in the stored event.
​
string
A global API key that protects all incoming requests. Senders must provide the key via an Authorization: Bearer <key> header or a ?key=<key> query parameter. Treat this value as a secret.
​
array
An IP or CIDR allowlist. When set, the actor only accepts traffic from the listed addresses or blocks. Leave empty for unrestricted public access. Example entries: 203.0.113.0/24, 198.51.100.1.
​
object
Configures automatic signature verification for a specific webhook provider. Set the shared secret in signatureVerificationSecret. Supported providers are stripe, shopify, github, slack, and custom.
​
string
The signing secret used by the provider configured in signatureVerification. Treat this value as a secret — it is stored encrypted and never surfaced in logs.
Control the HTTP response the actor sends back to the webhook sender.
​
integer
default:"200"
The HTTP status code returned to the sender for every captured request. Accepts any valid status code from 100 to 599. You can override this per-request using the __status query parameter on the webhook URL.
​
string
The exact response body returned to the sender. Supports JSON, XML, or plain text. Example: {"status": "received", "success": true}.
​
object
A key-value map of HTTP headers to include in every webhook response. Example: {"X-Custom": "Value", "Content-Type": "application/json"}.
​
integer
default:"0"
Artificial response latency in milliseconds added after the actor finishes processing. Accepts 0 to 10000. Use this to simulate slow or overloaded downstream systems. This delay is not included in the processingTime field on captured events.
Configure automatic forwarding of captured requests and control retry behavior for forwarding and replay operations.
​
string
When set, the actor automatically POSTs a copy of every captured request to this destination URL immediately after capture. Use this to pipe test traffic into a staging system while keeping a full audit trail.
​
boolean
default:"true"
When enabled, the original request headers are forwarded to forwardUrl along with the body. Disable this to send a clean request with only Content-Type and Content-Length.
​
integer
default:"3"
Maximum number of retry attempts for a failed forward delivery. Accepts 0 to 10. Retries use exponential backoff and circuit breaker protection.
​
integer
default:"3"
Maximum number of retry attempts when replaying a stored event to a target URL. Accepts 0 to 10.
​
integer
default:"10000"
Timeout per replay attempt in milliseconds. Accepts 1000 to 60000. Keeps a slow or unresponsive target from blocking the replay pipeline.
Validate incoming payloads and run inline transformations before storage.
​
string
A JSON Schema document (as a string) used to validate every incoming payload. Requests that do not match the schema are rejected with 400 Bad Request. Leave empty to accept any payload structure.
​
string
An inline JavaScript snippet that runs against each captured event before it is stored. Use it to normalize, enrich, or redact payload data. See Transform webhook payloads with custom JavaScript for full details, the script context, and usage examples.
Send real-time notifications to Slack or Discord when webhook events need attention.
​
string
A Slack incoming webhook URL. When set, the actor posts alert messages to the configured Slack channel for any trigger condition listed in alertOn.
​
string
A Discord webhook URL. When set, the actor posts alert messages to the configured Discord channel for any trigger condition listed in alertOn.
​
array
default:"[\"error\", \"5xx\"]"
A list of conditions that trigger an alert notification. Supported values:
You can apply most of these settings at runtime without restarting the actor. On Apify, the hot-reload manager polls for updated input automatically. Locally, it watches the storage/key_value_stores/default/INPUT.json file. Set DISABLE_HOT_RELOAD=true if you want a fixed configuration.