---
title: "Webhook Test Vectors"
method: GET
path: "/.well-known/webhook-test-vectors.json"
tags: ["jwks"]
---

# Webhook Test Vectors

`GET /.well-known/webhook-test-vectors.json`

## Request

- Base URL: `https://agentavow.com` (the document declares no server; this is the origin it was published from)
- URL: `https://agentavow.com/.well-known/webhook-test-vectors.json`
- Auth: none declared

Publish deterministic test vectors for the partner scan-change webhook.

Partners building a receive-side verifier for AgentAvow's outbound
``scan-change`` events can reproduce the HMAC locally and confirm
byte-for-byte agreement with our sender before a live shared secret
is exchanged. The canonical form is identical to what production
emits from ``src.trust.outbound_webhooks``.

Canonical form:
  ``body_bytes = json.dumps(body, separators=(",", ":"),
  sort_keys=True).encode("utf-8")``

Signature:
  ``X-Partner-Signature: sha256=<hex>`` where
  ``hex = hmac_sha256(shared_secret, body_bytes).hexdigest()``

Replay window: ``X-Partner-Timestamp`` (ISO-8601) must be within ±5
minutes of receive time.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/agentavow/apis/agentavow-api.md) · [All operations](https://skmtc.dev/agentavow/apis/agentavow-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentavow/apis/agentavow-api/revisions/e1e20476dbfc?raw)