Verify webhook signature

Verifies a webhook signature.

POST /v1/notifications/verify-webhook-signature

Verify webhook signature

cURL

curl --request POST \
  --url https://api-m.sandbox.paypal.com/v1/notifications/verify-webhook-signature \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "transmission_id": "69cd13f0-d67a-11e5-baa3-778b53f4ae55",
  "transmission_time": "2016-02-18T20:01:35Z",
  "cert_url": "cert_url",
  "auth_algo": "SHA256withRSA",
  "transmission_sig": "lmI95Jx3Y9nhR5SJWlHVIWpg4AgFk7n9bCHSRxbrd8A9zrhdu2rMyFrmz+Zjh3s3boXB07VXCXUZy/UFzUlnGJn0wDugt7FlSvdKeIJenLRemUxYCPVoEZzg9VFNqOa48gMkvF+XTpxBeUx/kWy6B5cp7GkT2+pOowfRK7OaynuxUoKW3JcMWw272VKjLTtTAShncla7tGF+55rxyt2KNZIIqxNMJ48RDZheGU5w1npu9dZHnPgTXB9iomeVRoD8O/jhRpnKsGrDschyNdkeh81BJJMH4Ctc6lnCCquoP/GzCzz33MMsNdid7vL/NIWaCsekQpW26FpWPi/tfj8nLA==",
  "webhook_id": "1JE4291016473214C",
  "webhook_event": {
    "id": "8PT597110X687430LKGECATA",
    "create_time": "2013-06-25T21:41:28Z",
    "resource_type": "authorization",
    "event_type": "PAYMENT.AUTHORIZATION.CREATED",
    "summary": "A payment authorization was created",
    "resource": {
      "id": "2DC87612EK520411B",
      "create_time": "2013-06-25T21:39:15Z",
      "update_time": "2013-06-25T21:39:17Z",
      "state": "authorized",
      "amount": {
        "total": "7.47",
        "currency": "USD",
        "details": {
          "subtotal": "7.47"
        }
      },
      "parent_payment": "PAY-36246664YD343335CKHFA4AY",
      "valid_until": "2013-07-24T21:39:15Z",
      "links": [
        {
          "href": "https://api-m.paypal.com/v1/payments/authorization/2DC87612EK520411B",
          "rel": "self",
          "method": "GET"
        },
        {
          "href": "https://api-m.paypal.com/v1/payments/authorization/2DC87612EK520411B/capture",
          "rel": "capture",
          "method": "POST"
        },
        {
          "href": "https://api-m.paypal.com/v1/payments/authorization/2DC87612EK520411B/void",
          "rel": "void",
          "method": "POST"
        },
        {
          "href": "https://api-m.paypal.com/v1/payments/payment/PAY-36246664YD343335CKHFA4AY",
          "rel": "parent_payment",
          "method": "GET"
        }
      ]
    }
  }
}
'

200

{}

Authorizations

Authorization · string · header · required

Oauth 2.0 authentication

Body

application/json

A verify webhook signature request.

auth_algo · string · required

The algorithm that PayPal uses to generate the signature and that you can use to verify the signature. Extract this value from the PAYPAL-AUTH-ALGO response header, which is received with the webhook notification.

Maximum string length: 100

Pattern: ^[a-zA-Z0-9]+$

cert_url · string<uri> · required

The X.509 public key certificate. Download the certificate from this URL and use it to verify the signature. Extract this value from the PAYPAL-CERT-URL response header, which is received with the webhook notification.

Maximum string length: 500

transmission_id · string · required

The ID of the HTTP transmission. Contained in the PAYPAL-TRANSMISSION-ID header of the notification message.

Maximum string length: 50

Pattern: ^(?!\d+$)\w+\S+

transmission_sig · string · required

The PayPal-generated asymmetric signature. Appears in the PAYPAL-TRANSMISSION-SIG header of the notification message.

Maximum string length: 500

Pattern: ^(?!\d+$)\w+\S+

transmission_time · string<date-time> · required

The date and time of the HTTP transmission, in Internet date and time format. Appears in the PAYPAL-TRANSMISSION-TIME header of the notification message.

Maximum string length: 100

webhook_id · string · required

The ID of the webhook as configured in your Developer Portal account.

Maximum string length: 50

Pattern: ^[a-zA-Z0-9]+$

webhook_event · Event · object · required

A webhook event notification.

Show child attributes

Response

200

application/json

A successful request returns the HTTP 200 OK status code and a JSON response body that shows the verification status.

The verify webhook signature response.

verification_status · enum<string> · required

The status of the signature verification.

Available options: SUCCESS, FAILURE