Prove possession of a webhook signing secret
Sparkles signs this request with the same Webhook-Id.Webhook-Timestamp.rawRequestBody algorithm as event delivery. Verification requests intentionally omit sequence and Webhook-Attempt. Read data.challenge and return base64(HMAC-SHA256(base64Decode(secret without whsec_), “sparkles.webhook.verify.” + challenge)) as response. Exact test vector: the example-only secret whsec_AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE= and the example challenge produce the example response.
Headers
The stable request identifier, equal to the UUID in the request body id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$Unix seconds for this request and the timestamp used in the signature input.
x <= 9007199254740991One or more space-separated v1,BASE64_HMAC values. Each HMAC-SHA256 signs Webhook-Id.Webhook-Timestamp.rawRequestBody with the base64-decoded whsec_ key.
^(?:v1,[A-Za-z0-9+/]{43}=)(?: v1,[A-Za-z0-9+/]{43}=)*$Body
Response
Signing-secret possession proved
Base64 HMAC-SHA256 of sparkles.webhook.verify. using the base64-decoded whsec_ key.
^[A-Za-z0-9+/]{43}=$