Webhook Safety Lab: Valid JSON Is Only The First Check
A payload can be perfectly valid JSON, satisfy every required field and still describe an action that should not be executed. This lab separates those questions instead of hiding them behind one green checkmark.
Send one payload through three different questions
The same input is checked first as JSON, then as a contract, and finally as an instruction whose meaning may depend on state outside the payload itself.
Syntax
WaitingCan the request body actually be parsed as JSON?
- No payload checked yet.
Schema
WaitingDoes the parsed object satisfy the contract expected by this demonstration?
- No payload checked yet.
Semantic
WaitingCan the payload alone prove that the requested action makes sense against current state?
- No payload checked yet.
Why one word - “valid” - is not enough
Validation becomes ambiguous as soon as a message is allowed to change external state.
Syntax asks whether we can read it
Missing braces, broken quotes and malformed separators belong here. If parsing fails, there is no object to reason about yet. This is the easiest failure to detect and the one traditional JSON validators handle well.
Schema asks whether we recognize it
A request may be valid JSON while still missing required fields, carrying an unsupported action or using the wrong value type. Passing syntax therefore says almost nothing about whether the message satisfies an API contract.
Semantics asks whether it makes sense now
Some actions depend on facts the JSON cannot contain reliably: whether an object still exists, what state it is currently in, whether an identifier still points to the intended object and whether the requested operation has already happened.
The endpoint can reject a command. It cannot execute one.
This is deliberately not a trading simulator.
The public endpoint behind this page receives a payload and exposes the result of several validation layers. It does not look up a live account, query an open position, inspect an exchange order or pass the request into AlgoWay's execution layer.
That limitation is the point of the experiment. A semantic warning demonstrates where static validation runs out of information. In a real state-changing system, the next step would have to consult authoritative current state before deciding whether an action is still legitimate.
The lab therefore does not answer “is this trade safe?” It answers a narrower and more useful engineering question: “what can this payload prove by itself, and where must the system stop pretending that the payload knows everything?”
