# QA Tools Webhook Inspector

> QA Tools (https://qa-tools.ru) gives you a temporary webhook endpoint with no account: create a session with `POST /api/sessions`, point the system under test at its `receiveUrl`, `https://hook.qa-tools.ru/s/{sessionId}`, then list what it received with `GET /api/sessions/{sessionId}/requests` (newest first, without bodies or headers unless asked for with `include=headers,body`, only what arrived after a request with `after`, and held until a request arrives with `wait`) and read one request in full — headers, body, raw request — with `GET /api/sessions/{sessionId}/requests/{requestId}`, and delete the session with everything it captured with `DELETE /api/sessions/{sessionId}` when you are done. A session can answer with a custom response (`status`, `headers`, `body` as a JSON string, `delayMs`), and with a queue of up to 10 such responses for the next requests first (`PUT /api/sessions/{sessionId}/queue`), to check a client's retries, keeps its newest 1000 requests of up to 1 MiB each, and expires 7 days after its last use unless you delete it sooner, or, created with `expiresAfterIdleSeconds`, that many seconds after its last use, or, created with `expiresInSeconds`, that many seconds after its creation, so that a test interrupted before its clean-up leaves nothing behind for long. One address may create 60 sessions and make 1200 other API calls a minute: the API's answers say what is left in `X-RateLimit-Remaining`, and a call over a limit answers `429` with `Retry-After`. One address may also have 128 calls in progress at a time, on the API and the MCP server together, waits included; the next is `429` with `errorCode` `1019` and `Retry-After: 1`. An agent with an MCP client can use the same service as seven tools from the MCP server `https://qa-tools.ru/mcp` (Streamable HTTP, no account). There are no accounts: a session's id is its access key, unless it was created with `{"private":true}`, when every call also presents its access key, `Authorization: Bearer <key>`, which the creation answers once as `accessKey`; do not send secrets.

Read `llms-full.txt` first: it is the whole guide for an agent in one file — how to wait for a webhook without WebSocket, how to clean up, the mistakes to avoid, and the complete API introduction and endpoint list.

## Docs

- [llms-full.txt](https://qa-tools.ru/llms-full.txt): the complete agent guide in Markdown, generated from the OpenAPI description at every release
- [openapi.json](https://qa-tools.ru/openapi.json): the OpenAPI 3.1 description of the public API
- [API reference](https://qa-tools.ru/docs): the same description rendered for people, with curl examples
- [changelog.md](https://qa-tools.ru/changelog.md): what changed in each version, newest first, with every change that can break an API client marked **Breaking:**
- [Status page](https://status.qa-tools.ru/): whether QA Tools is up — the site, the API and webhook receiving, each checked every minute from outside — with its uptime history and reports of outages; check it when a test that uses QA Tools fails