---
title: "Endpoint verification"
method: POST
path: "webhook.ping"
tags: ["Webhooks"]
---

# Endpoint verification

`POST webhook.ping` (webhook)

Sent when you verify an endpoint in the analytics dashboard. It carries no `data`. A 2xx
answer within 5 seconds marks the endpoint as verified; anything else marks the verification
as failed.

The body is signed exactly like `identification.scored`. Its keys are sorted alphabetically
and `created_at` has second precision. Worked example with the test secret
`whsec_00112233445566778899aabbccddeeff`: the body

```json
{"created_at":"2026-09-30T12:34:56Z","event_type":"webhook.ping","schema_version":"2026-06-01"}
```

arrives with `X-Shield-Signature: sha256=ea2685733d254f7028fb031c4214583b0650de01e6c8c93131236024edd9fdd8`.

## Headers

- `X-Shield-Signature` string, required
- `X-Shield-Event-Id` string

## Payload

- WebhookPingEvent: Body of a `webhook.ping` delivery, sent when you verify an endpoint. It has no `data`. The keys arrive sorted alphabetically and `created_at` has second precision.
  - `event_type` 'webhook.ping', required: Event type.
  - `schema_version` string, required: Schema version of the event type. Read event_type together with schema_version.
  - `created_at` string, date-time, required: RFC 3339 timestamp in UTC with up to 9 fractional digits (trailing zeros trimmed), for example `2026-09-30T12:34:57.482913041Z`. Parse it with a parser that accepts nanoseconds.
  - `event_id` string

## Acknowledgement `2XX`

Endpoint verified. The response body is ignored.

## Other responses

- `4XX`: Verification failed. Any status other than 2xx, and a timeout after 5 seconds, fails it.

---

[API](https://skmtc.dev/shieldlabs/apis/shieldlabs-api.md) - [All operations](https://skmtc.dev/shieldlabs/apis/shieldlabs-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shieldlabs/apis/shieldlabs-api/revisions/f8c7da1cd44d?raw)