POST <your webhook_url> (watchChallenge)

Call	POST <your webhook_url> (watchChallenge)
Price	free
Scope	none (Verdict calls you; verify Verdict-Signature)
Operation id	watchChallengeWebhook

What it does

Sent once when a watch is created. Respond 200 with {"challenge": <challenge>} within 10 seconds; the watch becomes active only then. Signed with Verdict-Signature like deliveries.

Example request

Verdict sends this request to your endpoint. The curl below replays it against your own server.

Request

curl -X POST 'https://your-app.example.com/verdict/webhook' \
  -H 'Verdict-Signature: t=1794060000,v1=5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "webhook.challenge",
  "watch_id": "wch_01JC3Z4Y8R9K2M5N7P1Q3S5T7V",
  "challenge": "cccccccccccccccccccccccccccccccccccccccc"
}'

Example response

200: The challenge, echoed.

200 response

{
  "challenge": "cccccccccccccccccccccccccccccccccccccccc"
}

Parameters

Name	In	Type	Required	Description
verdict-signature	header	string	yes	t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>" with the watch's signing secret>. Several v1 values appear while a secret rotation overlaps. Reject the delivery if no v1 matches or t is more than 5 minutes from your clock.

Request body

Schema WebhookChallenge. The challenge.

Field	Type	Required	Description
type	enum: “webhook.challenge”	yes	Payload type.
watch_id	string	yes	The watch being registered.
challenge	string	yes	Random string; respond 200 with {"challenge": <this value>} within 10 seconds.

Response fields (200)

Field	Type	Required	Description
challenge	string	yes	The challenge value, echoed.

Try it

Open the interactive reference to send this request from the browser. The full document is at /openapi.json.