Endpoint verification handshake
Event name: endpoint.verification
Endpoint-verification handshake. Sent when a customer saves or clicks "Verify" on a Webhooks URL. Your endpoint must reply HTTP 200 with the lowercase hex HMAC-SHA256 of the nonce, keyed by your signing secret: hex(HMAC-SHA256(signing_secret, nonce)). Synup accepts the URL only if the returned digest matches. This request carries no location_id and no data object.
Headers
sha256=base64(HMAC-SHA256(signing_secret, raw_request_body)). Verify with your signing secret before processing; reject on mismatch.
Payload
Response
Reply with HTTP 200 and a body containing the lowercase hex HMAC-SHA256 of the nonce keyed by your signing secret. Synup compares it to its own computation and marks the endpoint verified on a match.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.