Testing Outbound Webhooks with Signed Payloads and Retry Logic

Outbound webhook testing is tricky because the system under test is the caller, so it needs a receiver that verifies signatures and mimics real endpoint failures. Public request-bin endpoints only confirm that a request was sent, not that its HMAC is correct or that a tampered body would be rejected. A local mock receiver can instead recompute the signature over the raw request bytes, making signing errors fail tests reliably. Such a mock can also be configured to return a 500 on the first attempt, letting tests confirm that the producer retries and reuses the same event ID. Generating the mock from an OpenAPI spec adds schema validation, catching undocumented fields or wrong types in delivered payloads.