Concepts

A short glossary of the terms used throughout these docs.

Workspace

A workspace is the boundary that owns endpoints, events, API keys, and members. Every captured event belongs to exactly one workspace, and that boundary is enforced at the database level. A workspace has an opaque id in the form wk_ followed by twelve characters, which is immutable for the life of the workspace.

Endpoint

An endpoint is a permanent webhook URL you configure in a provider. Its URL has the shape:

https://hooks.catchbin.io/{workspace-id}/{slug}

The {slug} is yours to choose (^[a-z0-9][a-z0-9_-]{0,63}$) and must be unique within your workspace — two different workspaces can both use stripe-prod. You create one endpoint per integration context: one for Stripe dev, one for Stripe staging, one for a GitHub org, and so on.

Each endpoint carries three independent settings:

• Provider — Stripe, GitHub, Shopify, or Generic. This selects the signature scheme catchbin verifies against.
• Operating mode — how much of each request is stored, and whether it is forwarded. See Operating modes.
• Lifecycle status — active or archived. An archived endpoint returns 404 to the provider but keeps its stored events.

Event

An event is a single captured webhook request: its method, headers, raw body bytes, timestamp, remote IP, and the result of signature verification. If the request was forwarded or replayed, the response is stored alongside it. Events are retained for the length of your plan’s retention window and can be inspected, exported as curl, and replayed.

Note

Headers and bodies are encrypted at rest with a key scoped to your workspace. Credential headers such as Authorization and Cookie are masked in the dashboard by default, with an explicit reveal. catchbin never writes a payload, secret, or header value to its logs. See Security & privacy.

Capture

Capture is what catchbin’s cloud receiver does the moment a webhook arrives: it stores the request and answers the provider with 200 OK in a few milliseconds — independent of whether your own server is running. See How capture works.

Forward

Forwarding is the CLI re-sending captured events to a local (or any) target in real time over a persistent connection. Forwarding is what replaces a tunnel for local development. See Forward to localhost.

Replay

Replay re-sends a single already-captured event to a target of your choice — after you fix a bug, or to move an event to staging. You can strip the provider signature or re-sign for the target. See Replay an event.

Signature verification

For each inbound request, catchbin recomputes the provider’s expected signature from your stored signing secret and compares it to what arrived. When it does not match, catchbin runs a provider-specific diagnostic that names the likely cause instead of returning an opaque failure. See Verify signatures.