COcollectwise

Verify API security

Changed on

Check signing and the observed source IP before enabling enforcement. A valid key is always required. If any usable current/grace signing secret exists, its valid signature is required even when enforcement is off. With signing off and no secret, signature is skipped; required signing with no secret returns 401. Failed signature never reveals IP details. No provider calls, business/settings writes or last-used updates. An authenticated IP mismatch can return 200, so inspect ipAllowlistEnabled and ipMatch.

post/security/verify

Request

  • Base URL
    https://collectwiseapi.com
  • URL
    https://collectwiseapi.com/security/verify
  • Auth
    API key in header collectwise_key

Headers

x-cw-timestampstring

Required together with x-cw-signature when signing is enabled for this key or organization. POST /security/verify also requires signing whenever a usable secret exists. Canonical Unix seconds, within ±300 seconds. See API Access for CW1 signing.

x-cw-signaturestring

CW1 HMAC-SHA256 signature: v1= followed by 64 lowercase hex digits. Use the decoded 32-byte signing secret and exact request bytes. See API Access.

Request body

object required

Optional JSON object. Contents are not used; sign the exact bytes sent.

Response

Authenticated diagnostics. An IP mismatch is reported here instead of denied; normal business routes still enforce it. No business/settings/last-used writes.

signature'verified' | 'skipped' required
signingRequiredboolean required
sourceIpstring required

Trusted caller IP from API Gateway. Documentation examples use TEST-NET addresses.

ipAllowlistEnabledboolean required
ipMatchboolean required

Whether the caller matches a saved range, independent of enforcement. False when there are no saved ranges.

Changes