Open-source tool to test merchant webhook handlers against Hyperswitch outgoing webhooks (duplicates, ordering, signatures)

[Pritom14]

Hi all! I maintain carbon-layer, an open-source (Apache-2.0) CLI for testing how a merchant's webhook handler behaves under failure conditions. v0.8.0 adds Hyperswitch outgoing webhooks, so if you're integrating with Hyperswitch you can test your receiver locally without a running deployment.

What it sends

• Hyperswitch's OutgoingWebhook envelope: {merchant_id, event_id, event_type, content: {type, object}, timestamp}.
• Event types payment_succeeded, payment_failed, payment_authorized, refund_succeeded, refund_failed and dispute_opened.
• Signed the way the router does it: a hex HMAC-SHA512 of the raw body, keyed with the payment response hash key, in X-Webhook-Signature-512.

What it tests

• Duplicate deliveries: repeats share the same event_id.
• Out-of-order delivery.
• Missing, corrupted or wrong-key signatures.
• Side effects, not just status codes: a handler that fulfils an order twice still returns 200, so --verify-cmd counts what your handler actually did.

pip install carbon-layer
carbon run refund-storm --provider hyperswitch \
  --webhook-url http://localhost:8000/webhooks/hyperswitch \
  --webhook-secret $PAYMENT_RESPONSE_HASH_KEY \
  --webhook-repeat 2 --webhook-order random \
  --verify-cmd "psql -tAc 'select count(*) from fulfilments'" --verify-event payment_succeeded

Against a receiver with no dedupe, this reports FAIL: duplicate processing: payment_succeeded: 100 unique events caused 200 side effects.

I built the payload shapes from crates/api_models/src/webhooks.rs and the signing from crates/router/src/core/webhooks/types.rs. If I've got any field or event semantics wrong, for example which event merchants should treat as final for capture, I'd really appreciate a correction. I'm also happy to add more event types that people need.