diff --git a/InvenTree/common/tests.py b/InvenTree/common/tests.py
index 30fcd9cb41..dbc7fc6ed1 100644
--- a/InvenTree/common/tests.py
+++ b/InvenTree/common/tests.py
@@ -120,10 +120,74 @@ class WebhookMessageTests(TestCase):
         )
 
         assert response.status_code == HTTPStatus.FORBIDDEN
-        assert (
-            json.loads(response.content)['detail'] == WebhookView.MESSAGE_TOKEN_ERROR
+        assert (json.loads(response.content)['detail'] == WebhookView.MESSAGE_TOKEN_ERROR)
+
+    def test_bad_url(self):
+        response = self.client.post(
+            f'/api/webhook/1234/',
+            content_type='application/json',
         )
 
+        assert response.status_code == HTTPStatus.NOT_FOUND
+
+    def test_bad_json(self):
+        response = self.client.post(
+            self.url,
+            data="{'this': 123}",
+            content_type='application/json',
+            **{'HTTP_TOKEN': str(self.endpoint_def.token)},
+        )
+
+        assert response.status_code == HTTPStatus.NOT_ACCEPTABLE
+        assert (
+            json.loads(response.content)['detail'] == 'Expecting property name enclosed in double quotes'
+        )
+
+    def test_success_no_token_check(self):
+        # delete token
+        self.endpoint_def.token = ''
+        self.endpoint_def.save()
+
+        # check
+        response = self.client.post(
+            self.url,
+            content_type='application/json',
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        assert json.loads(response.content)['message'] == WebhookView.MESSAGE_OK
+
+    def test_bad_hmac(self):
+        # delete token
+        self.endpoint_def.token = ''
+        self.endpoint_def.secret = '123abc'
+        self.endpoint_def.save()
+
+        # check
+        response = self.client.post(
+            self.url,
+            content_type='application/json',
+        )
+
+        assert response.status_code == HTTPStatus.FORBIDDEN
+        assert (json.loads(response.content)['detail'] == WebhookView.MESSAGE_TOKEN_ERROR)
+
+    def test_success_hmac(self):
+        # delete token
+        self.endpoint_def.token = ''
+        self.endpoint_def.secret = '123abc'
+        self.endpoint_def.save()
+
+        # check
+        response = self.client.post(
+            self.url,
+            content_type='application/json',
+            **{'HTTP_TOKEN': str('68MXtc/OiXdA5e2Nq9hATEVrZFpLb3Zb0oau7n8s31I=')},
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        assert json.loads(response.content)['message'] == WebhookView.MESSAGE_OK
+
     def test_success(self):
         response = self.client.post(
             self.url,