---
title: "Endpoint verification handshake"
method: POST
path: "endpoint.verification"
tags: ["Webhooks"]
---

# Endpoint verification handshake

`POST endpoint.verification` (webhook)

**Event name:** `endpoint.verification`

Endpoint-verification handshake. Sent when a customer saves or clicks "Verify" on a Webhooks URL. Your endpoint must reply HTTP 200 with the lowercase hex HMAC-SHA256 of the nonce, keyed by your signing secret: hex(HMAC-SHA256(signing_secret, nonce)). Synup accepts the URL only if the returned digest matches. This request carries no location_id and no data object.

## Headers

- `X-Synup-Signature` string, required

## Payload

- object
  - `event` string: Always "endpoint.verification".
  - `nonce` string: Random challenge string. HMAC this (keyed by your signing secret) and return the hex digest.
  - `timestamp` string: ISO-8601 UTC emit time.

## Acknowledgement `200`

Reply with HTTP 200 and a body containing the lowercase hex HMAC-SHA256 of the nonce keyed by your signing secret. Synup compares it to its own computation and marks the endpoint verified on a match.

---

[API](https://skmtc.dev/synup/apis/synup-api.md) - [All operations](https://skmtc.dev/synup/apis/synup-api/llms.txt) - [OpenAPI document](https://skmtc.dev/synup/apis/synup-api/revisions/67de2d51c22e?raw)