# Endpoint verification handshake

**Event:** `endpoint.verification`

**Event name:** `endpoint.verification`

Endpoint-verification handshake. Sent when a customer saves or clicks "Verify" on a Webhooks URL. Your endpoint must reply HTTP 200 with the lowercase hex HMAC-SHA256 of the nonce, keyed by your signing secret: hex(HMAC-SHA256(signing_secret, nonce)). Synup accepts the URL only if the returned digest matches. This request carries no location_id and no data object.

Source: https://developer.synup.com/webhooks/endpoint-verification

## Header parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `X-Synup-Signature` | string | required | sha256=base64(HMAC-SHA256(signing_secret, raw_request_body)). Verify with your signing secret before processing; reject on mismatch. |

## Request body

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `event` | string | optional | Always "endpoint.verification". |
| `nonce` | string | optional | Random challenge string. HMAC this (keyed by your signing secret) and return the hex digest. |
| `timestamp` | string | optional | ISO-8601 UTC emit time. |

## Responses

| Status | Description |
| --- | --- |
| `200` | Reply with HTTP 200 and a body containing the lowercase hex HMAC-SHA256 of the nonce keyed by your signing secret. Synup compares it to its own computation and marks the endpoint verified on a match. |