If you have ever said “the webhook handler looks fine, but production still broke,” this is probably why. You are not really testing one POST request. You are testing the relationship between a mutation, the state it leaves behind, and an event that shows up later.
What usually breaks
- signature verification running against a parsed body instead of the raw body
- retry behavior creating duplicate side effects
- handlers assuming event order is always ideal
- apps testing only the webhook and never the state transition that triggered it
What to include in your test setup
A decent test setup lets you create the upstream resource first, check the state after that, and then verify the event your app was waiting for. If all you have is a pasted webhook payload, you are only testing the easiest slice of the problem.
Even if you never use FetchSandbox, the rule still holds: test the flow, not just the callback handler.