Twilio incoming SMS webhook payload example

Twilio · event: incoming SMS (form-urlencoded) · content type: application/x-www-form-urlencoded

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into Twilio's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/x-www-form-urlencoded
user-agent: TwilioProxy/1.1
x-twilio-signature: GvWf1cFY/Q7PnoempGyD5oXAezc=
i-twilio-idempotency-token: 7f3a2b1c-9d8e-4f6a-b5c4-d3e2f1a0b9c8

Body

ToCountry=US&
  ToState=CA&
  SmsMessageSid=SMa1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6&
  NumMedia=0&
  ToCity=SAN+FRANCISCO&
  FromZip=94105&
  SmsSid=SMa1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6&
  FromState=CA&
  SmsStatus=received&
  FromCity=SAN+FRANCISCO&
  Body=Hello%2C+testing+my+webhook%21&
  FromCountry=US&
  To=%2B14155551234&
  ToZip=94103&
  NumSegments=1&
  MessageSid=SMa1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6&
  AccountSid=ACa1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6&
  From=%2B14155556789&
  ApiVersion=2010-04-01

Things that bite people

Twilio sends application/x-www-form-urlencoded, not JSON — JSON-only body parsers see an empty body. (A Hookden bin decodes form fields into a table automatically.)
X-Twilio-Signature is base64 HMAC-SHA1 over the full URL + alphabetically-sorted POST params — the URL Twilio used must match yours exactly (https, port, trailing slash). Test it in the signature debugger.
Your HTTP response controls Twilio: reply with TwiML to answer the SMS, or empty <Response/> to do nothing. More: Twilio webhook debugging.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/x-www-form-urlencoded' \
  -H 'user-agent: TwilioProxy/1.1' \
  -H 'x-twilio-signature: GvWf1cFY/Q7PnoempGyD5oXAezc=' \
  -H 'i-twilio-idempotency-token: 7f3a2b1c-9d8e-4f6a-b5c4-d3e2f1a0b9c8' \
 -d 'ToCountry=US&ToState=CA&SmsMessageSid=SMa1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6&NumMedia=0&ToCity=SAN+FRANCISCO&FromZip=94105&SmsSid=SMa1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6&FromState=CA&SmsStatus=received&FromCity=SAN+FRANCISCO&Body=Hello%2C+testing+my+webhook%21&FromCountry=US&To=%2B14155551234&ToZip=94103&NumSegments=1&MessageSid=SMa1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6&AccountSid=ACa1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6&From=%2B14155556789&ApiVersion=2010-04-01'

← All payload examples · Related guide · Signature debugger · Docs