---
title: "Verify API security"
method: POST
path: "/security/verify"
---

# Verify API security

`POST /security/verify`

## Request

- Base URL: `https://collectwiseapi.com`
- URL: `https://collectwiseapi.com/security/verify`
- Auth: API key in header `collectwise_key`

Check signing and the observed source IP before enabling enforcement. A valid key is always required. If any usable current/grace signing secret exists, its valid signature is required even when enforcement is off. With signing off and no secret, signature is skipped; required signing with no secret returns 401. Failed signature never reveals IP details. No provider calls, business/settings writes or last-used updates. An authenticated IP mismatch can return 200, so inspect ipAllowlistEnabled and ipMatch.

## Headers

- `x-cw-timestamp` string
- `x-cw-signature` string

## Request body

- object: Optional JSON object. Contents are not used; sign the exact bytes sent.

## Response `200`

Authenticated diagnostics. An IP mismatch is reported here instead of denied; normal business routes still enforce it. No business/settings/last-used writes.

- object
  - `signature` 'verified' | 'skipped', required
  - `signingRequired` boolean, required
  - `sourceIp` string, required: Trusted caller IP from API Gateway. Documentation examples use TEST-NET addresses.
  - `ipAllowlistEnabled` boolean, required
  - `ipMatch` boolean, required: Whether the caller matches a saved range, independent of enforcement. False when there are no saved ranges.

## Other responses

- `400`: Malformed JSON body.
- `401`: Unauthorized key or signature; generic error without IP details.
- `413`: Body exceeds 100 KiB.
- `415`: Unsupported body content type, compression or charset.
- `429`: Your organization's shared rate limit has been exceeded. Wait at least the number of seconds specified in Retry-After before retrying.
- `503`: Security dependency or trusted request metadata unavailable.

## Changes

- **2026-11-03** `95fad0d2f369`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/collectwise/apis/collectwise-api/changes/security/verify/post.md)

---

[API](https://skmtc.dev/collectwise/apis/collectwise-api.md) - [All operations](https://skmtc.dev/collectwise/apis/collectwise-api/llms.txt) - [OpenAPI document](https://skmtc.dev/collectwise/apis/collectwise-api/revisions/95fad0d2f369?raw)