HTTP capture
A request bin with a programmable reply — point a webhook at it and see exactly what your provider would have sent.
Capture URLs
Every sandbox gets a host of its own: https://<sandbox-id>.trapit.dev — the same id
that is its SMTP username. Any path,
any method, any body — it is all trapped and nothing is forwarded.
POST https://YOUR-SANDBOX-ID.trapit.dev/webhooks/payment?attempt=2 GET https://YOUR-SANDBOX-ID.trapit.dev/anything/you/like
Capture hosts live on trapit.dev, a different registrable domain from the one serving this dashboard. That is deliberate: a capture endpoint returns a response its caller controls, so keeping it off the app's domain means a session cookie can never be sent to one.
Mock responses
Each sandbox has a reply you control — status code, headers and body — returned to every request
it traps. Set it to what the real service would return, or to a 500 to see what your
retry logic does:
status 201 headers Content-Type: application/json body {"id":"evt_123","status":"queued"}
Bodies over 5 MB are refused with a
413. Ingress is rate limited at
600 requests per
60 s per source IP and
3000 per workspace; over the
limit is a 429 with Retry-After. The full table of limits is on
the REST API page.
What gets recorded
- Method, path and query string, separately.
- Every request header as sent.
- The body, kept verbatim, with the raw bytes available.
- The source IP, and the mock status code that was returned.
Reading it back
GET https://trapit.dev/api/v1/sandboxes/{sandboxId}/requests lists what a sandbox has
caught, and …/requests/wait blocks until one matching your method and path filter
arrives — no polling loop. From an agent, wait_for_request does the same, and
extract_from_body pulls a value straight out of the JSON by
dotted path — user.id, items.0.name.