Endpoint verification handshake

Webhook

POST

endpoint.verification

Event name: endpoint.verification

Endpoint-verification handshake. Sent when a customer saves or clicks "Verify" on a Webhooks URL. Your endpoint must reply HTTP 200 with the lowercase hex HMAC-SHA256 of the nonce, keyed by your signing secret: hex(HMAC-SHA256(signing_secret, nonce)). Synup accepts the URL only if the returned digest matches. This request carries no location_id and no data object.

Request

Header Params

Body Params application/json

Example

{
    "event": "endpoint.verification",
    "nonce": "a1b2c3d4e5f6a7b8c9d0",
    "timestamp": "2026-07-15T14:00:00Z"
}

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

curl --location 'https://your-api-server.com' \
--header 'X-Synup-Signature: sha256=Base64Signature==' \
--header 'Content-Type: application/json' \
--data '{
    "event": "endpoint.verification",
    "nonce": "a1b2c3d4e5f6a7b8c9d0",
    "timestamp": "2026-07-15T14:00:00Z"
}'

Responses

🟢200

text/plain

Reply with HTTP 200 and a body containing the lowercase hex HMAC-SHA256 of the nonce keyed by your signing secret. Synup compares it to its own computation and marks the endpoint verified on a match.

Bodytext/plain

Example

9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

Modified at 2026-07-15 18:04:40

AI idea image generation failed

ListFoldersResponse