Verify a request signature (self-test)

curl -X POST https://client.api.corpx.com/v1/security/signature/verify \
     -H "X-Content-SHA256: X-Content-SHA256" \
     -H "X-Request-Signature: X-Request-Signature" \
     -H "X-Request-Timestamp: X-Request-Timestamp" \
     -H "X-Tenant-Id: X-Tenant-Id" \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "path": "/v1/accounts/acc-123/pix/payments",
  "method": "POST",
  "timestamp": "1789412400",
  "idempotencyKey": "9a5f8c2e-1b3d-4e6f-8a7b-0c1d2e3f4a5b",
  "contentSha256": "3f9a2b1c0d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a",
  "body": "{\"ok\":true}",
  "signature": "MEUCIQDx...base64url"
}'

{
  "valid": true,
  "canonicalString": "POST\n/v1/accounts/2e6b725b-84a0-400d-8740-22a5ba0f23e6/pix/out\n\n3f9a2b1c...\n1770000000",
  "reason": "Pagamento pedido #12345",
  "message": "Pagamento pedido #12345",
  "expectedContentSha256": "3f9a2b1c0d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a",
  "signedHost": "client.api.corpx.com",
  "maxSkewSeconds": 300,
  "usableKids": [
    "string"
  ],
  "kid": "sha256:3f9a2b1c0d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a",
  "alg": "ES256"
}

Rebuilds the canonical string from what you send and verifies the detached JWS against the caller’s own public keys. Use it to get your signing implementation right before the first real transaction.

Always answers 200 (except on a malformed body), including when the signature is invalid: a 401 here would be indistinguishable from “your token expired” and would send you debugging the wrong thing. Creates nothing and moves nothing.

Rebuilds the canonical string from what you send and verifies the detached JWS against the **caller's own** public keys. Use it to get your signing implementation right before the first real transaction. Always answers `200` (except on a malformed body), including when the signature is invalid: a `401` here would be indistinguishable from "your token expired" and would send you debugging the wrong thing. Creates nothing and moves nothing.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Headers

X-Content-SHA256stringRequired

Lowercase hex SHA-256 of the body. An empty body hashes the empty string, so the header is always present. Mismatch returns 400 body_hash_mismatch.

Request

This endpoint expects an object.

pathstringRequired

Path including the query string, no host.

methodstringOptional

HTTP method of the hypothetical request. Defaults to POST.

timestampstringOptional

Unix seconds, same value as X-Request-Timestamp.

idempotencyKeystringOptional

Value of Idempotency-Key, or empty when the route has none.

contentSha256stringOptional

Lowercase hex SHA-256 of the body. Omit and we compute it from body — that is the step most integrators get wrong.

bodystringOptional

Raw body of the hypothetical request, as a string.

signaturestringOptional

Detached JWS <protected>..<signature>.

Response

Verification result (including failures).

validboolean

canonicalStringstring

The exact string the server signed over. Compare it with yours.

reasonstringOptional

Present only when valid is false. One of request_signature_invalid, request_timestamp_skew, unknown_kid, body_hash_mismatch, signature_missing, no_credential, no_public_key.

messagestringOptional

expectedContentSha256stringOptional

signedHoststringOptional

maxSkewSecondsintegerOptional

usableKidslist of stringsOptional

Keys currently usable by this credential (past their grace period).

kidstringOptional

algenumOptional

Errors

400

Bad Request Error

500

Internal Server Error