Hardcore test-all-the-things people would likely tell you to break whatever is in step 2 up into functions such that the webhook data are passed as parameters i

Hardcore test-all-the-things people would likely tell you to break whatever is in step 2 up into functions such that the webhook data are passed as parameters into a function, that all the HTTP request/response work is encapsulated into a separate function, and that the function under test should make calls to these. Really hardcore ones might even suggest having separate functions for all these things, each of which can be tested as a single unit. These people are, in my view, making a categorical error (that more testing of this sort means higher confidence and better quality code).