EVENTendpoint.verification

Endpoint verification handshake

Event name: endpoint.verification

Endpoint-verification handshake. Sent when a customer saves or clicks "Verify" on a Webhooks URL. Your endpoint must reply HTTP 200 with the lowercase hex HMAC-SHA256 of the nonce, keyed by your signing secret: hex(HMAC-SHA256(signing_secret, nonce)). Synup accepts the URL only if the returned digest matches. This request carries no location_id and no data object.

Every delivery is signed. Verify X-Synup-Signature before processing — see Synup Webhooks.

Payload

Name	Type	Required	Description
`event`	string	optional	Always "endpoint.verification".
`nonce`	string	optional	Random challenge string. HMAC this (keyed by your signing secret) and return the hex digest.
`timestamp`	string	optional	ISO-8601 UTC emit time.

Example delivery

{
  "event": "endpoint.verification",
  "nonce": "a1b2c3d4e5f6a7b8c9d0",
  "timestamp": "2026-07-15T14:00:00Z"
}