GitLab webhooks
Test and debug GitLab webhooksfor pipelines, merge requests and releases
GitLab sends events across repos, pipelines and merge requests. Hooklistener captures every payload so you can check the data and find the failure.
How GitLab webhooks work
| Where to configure it | Project or group > Settings > Webhooks > Add new webhook. |
|---|---|
| Signing token | webhook-signature carries HMAC-SHA256 signatures as v1,{base64}, alongside webhook-id and webhook-timestamp. The older secret token is sent as plain text in X-Gitlab-Token. |
| Auto-disable | Temporarily disabled after four consecutive failures (4xx, 5xx, timeouts) and permanently disabled after 40. |
| Test and resend | Test sends a sample request (a 2xx re-enables a disabled hook); Recent events > Resend Request repeats a delivery with the same Idempotency-Key. |
Sources (checked November 2026)
Debug GitLab events without slowing down delivery
GitLab webhooks power CI/CD triggers, release notifications and team workflows. When a payload breaks, the problem is usually hidden in headers, JSON shape, or a downstream integration that fails silently.
Hooklistener gives you a record of every GitLab request so you can inspect the event, spot malformed fields and forward it to staging or your local machine.
Why GitLab teams need a debugger
Pipeline failures are hard to trace
A webhook may fire correctly while a deployment step fails later. You need the full request to tell whether the issue started in GitLab or downstream.
Merge request payloads change constantly
MR events include nested state, approvals and commit data. Guessing which field your automation expects leads to broken jobs.
Release hooks need reliable delivery
Missing a release event can break notifications or changelog automation, and nobody notices until a customer asks.
How Hooklistener helps with GitLab webhooks
Inspect GitLab pipeline payloads
Read the full headers and JSON of each GitLab pipeline or push event, so you can tell whether a failed deploy step started with GitLab's request or further downstream.
Diff two merge request events
Compare two captured GitLab merge request payloads to see which approval, state or commit field changed, instead of guessing what your automation receives.
Inactivity monitors for release hooks
Get an email, Slack or signed-webhook alert when GitLab release events stop arriving, and use replay (Pro) to resend a missed release to your changelog job.
Try it: point GitLab at a free webhook URL or run a test with the webhook tester.
Common GitLab webhook workflows
CI/CD automation
Trigger build, test or deploy jobs when branches, tags or pipeline statuses change.
Merge request notifications
Send approvals, comments and review status updates into Slack or internal tooling.
Release and changelog sync
Update release notes, status pages and customer-facing changelogs when GitLab publishes a new release event.
Replay a failed webhook without re-triggering the provider
Once a delivery is captured, you can resend its exact headers and body to localhost, staging or production from the dashboard or through your coding agent over MCP, so the provider never has to fire a new event. Replay is on Pro and above. Read the replay guide.
Comparing webhook debugging tools?
See how Hooklistener stacks up against webhook.site, RequestBin, Beeceptor, Hookdeck and ngrok in the best tools to capture and inspect webhook payloads, or read the head-to-head pages for Hooklistener vs ngrok and Hooklistener vs Beeceptor.
Frequently asked questions
Can I debug GitLab pipeline webhooks?
Yes. Hooklistener captures pipeline events and shows the full payload. Forward them to localhost with hooklistener tunnel. Replay is on Pro and above.
Does this help with merge request automations?
It does. You can inspect merge request payloads, approvals and state changes to check the exact event your workflow receives.
What if GitLab retries a failed delivery?
Each attempt is captured as its own request, so you can compare repeated attempts in the history and see what changed.
Is this useful for self-managed GitLab too?
Yes. Any GitLab instance that can send outbound webhooks to a public HTTPS URL can send them to Hooklistener.
Make GitLab webhooks easier to trust
Capture and inspect GitLab events before they break your CI/CD or release automation.