Free tool · no signup required
Is my webhook safe from duplicate requests?
Paste a webhook or HTTP endpoint below. We'll fire 3 identical requests at it in parallel — the same "retry storm" a flaky network or an over-eager automation tool can cause — and tell you whether the responses look idempotent.
This is an HTTP-level heuristic based only on the responses your endpoint sent back to 3 rapid identical requests — we can't see your database or billing system. A "likely safe" result isn't a guarantee, and a "vulnerable" result is strong evidence, not certainty. Test with a non-production endpoint if you're not sure.
Wrap this endpoint with AgentRaaS to enforce idempotency
AgentRaaS sits in front of your real API calls, hashes each request, and returns the cached result on any retry — so a duplicate call never becomes a duplicate charge. Self-hosted and unlimited, or start free on Cloud.
Get started free →
How this works
- You give us a URL. Our server validates it isn't pointed at an internal/private address, then fires 3 identical
POST requests at it at the same time.
- We compare the 3 responses. If your endpoint returns the exact same response 3 times, that's consistent with idempotent handling — a retry, or a workflow re-run, doesn't create a second side effect.
- If the 3 responses differ (e.g. 3 different auto-generated IDs), that's consistent with the endpoint treating each request as a brand-new action — the classic "double-charge" failure mode.
Only run this against endpoints you own or have permission to test — each audit fires 3 real requests at the URL you provide. Limited to a few audits per IP per 15 minutes to keep this tool available for everyone.