openapi: 3.2.0
info:
  title: Synup Webhooks API
  version: 1.0.0
  description: 'Synup account webhook events. A single account-level HTTPS Webhooks URL receives every event; there is no per-event subscription. Every delivery is signed with X-Synup-Signature: sha256=base64(HMAC-SHA256(signing_secret, raw_request_body)), and deliveries only start after the endpoint.verification challenge-response handshake passes.


    ASSEMBLED BY API EVANGELIST from the per-event OpenAPI 3.1 documents Synup publishes at developer.synup.com; the webhook payload schemas are verbatim provider content. Guide: https://developer.synup.com/synup-webhooks-doc-2259000'
  contact:
    name: Synup Webhooks Guide
    url: https://developer.synup.com/synup-webhooks-doc-2259000
tags:
- name: Webhooks
paths: {}
webhooks:
  endpoint.verification:
    post:
      summary: Endpoint verification handshake
      deprecated: false
      description: '<span style="font-size: 14px;">


        **Event name:** `endpoint.verification`


        Endpoint-verification handshake. Sent when a customer saves or clicks "Verify" on a Webhooks URL. Your endpoint must reply HTTP 200 with the lowercase hex HMAC-SHA256 of the nonce, keyed by your signing secret: hex(HMAC-SHA256(signing_secret, nonce)). Synup accepts the URL only if the returned digest matches. This request carries no location_id and no data object.


        </span>'
      tags:
      - Webhooks
      parameters:
      - name: X-Synup-Signature
        in: header
        description: sha256=base64(HMAC-SHA256(signing_secret, raw_request_body)). Verify with your signing secret before processing; reject on mismatch.
        required: true
        example: sha256=Base64Signature==
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                event:
                  type: string
                  description: Always "endpoint.verification".
                nonce:
                  type: string
                  description: Random challenge string. HMAC this (keyed by your signing secret) and return the hex digest.
                timestamp:
                  type: string
                  description: ISO-8601 UTC emit time.
              x-apidog-orders:
              - event
              - nonce
              - timestamp
            example:
              event: endpoint.verification
              nonce: a1b2c3d4e5f6a7b8c9d0
              timestamp: '2026-07-15T14:00:00Z'
      responses:
        '200':
          description: Reply with HTTP 200 and a body containing the lowercase hex HMAC-SHA256 of the nonce keyed by your signing secret. Synup compares it to its own computation and marks the endpoint verified on a match.
          content:
            text/plain:
              schema:
                type: string
              example: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
          headers: {}
          x-apidog-name: ''
      security: []
      x-apidog-folder: Webhooks
      x-apidog-status: released
      x-run-in-apidog: https://app.apidog.com/web/project/797384/apis/api-40142150-run