Skip to main content
POST
Verify API security

Authorizations

collectwise_key
string
header
required

Active, unexpired API key belonging to an active organization. Optional organization/key signing and organization IP restrictions also apply; see API Access.

Headers

x-cw-timestamp
string

Required together with x-cw-signature when signing is enabled for this key or organization. POST /security/verify also requires signing whenever a usable secret exists. Canonical Unix seconds, within ±300 seconds. See API Access for CW1 signing.

Pattern: ^(0|[1-9][0-9]*)$
x-cw-signature
string

CW1 HMAC-SHA256 signature: v1= followed by 64 lowercase hex digits. Use the decoded 32-byte signing secret and exact request bytes. See API Access.

Pattern: ^v1=[0-9a-f]{64}$

Body

application/json

Optional JSON object. Contents are not used; sign the exact bytes sent.

Response

Authenticated diagnostics. An IP mismatch is reported here instead of denied; normal business routes still enforce it. No business/settings/last-used writes.

signature
enum<string>
required
Available options:
verified,
skipped
signingRequired
boolean
required
sourceIp
string
required

Trusted caller IP from API Gateway. Documentation examples use TEST-NET addresses.

ipAllowlistEnabled
boolean
required
ipMatch
boolean
required

Whether the caller matches a saved range, independent of enforcement. False when there are no saved ranges.