Sinbad Partner API

Before you receive events

Register an endpoint, store its signing secret, and verify the receiver.
Subscribe the endpoint to this event type.
Verify the timestamp and signature against the raw request body before you parse or acknowledge it. See Webhooks.

POST <your receiver URL>
Content-Type: application/json
Sinbad-Webhook-Id: evt_demo
Sinbad-Webhook-Timestamp: <Unix seconds>
Sinbad-Webhook-Signature: v1=<keyId>:<HMAC-SHA256 hex>

Payload examples

Verification challenge

{
  "id": "evt_demo",
  "type": "webhook.test",
  "apiVersion": "2026-10-22",
  "environment": "sinbad-staging-env",
  "partnerId": "partner_demo",
  "integrationId": "integration_demo",
  "partnerUserId": null,
  "tradeId": null,
  "sequence": null,
  "occurredAt": "2026-10-23T10:00:00.000Z",
  "sourceCommittedAt": "2026-10-23T10:00:00.000Z",
  "recordedAt": "2026-10-23T10:00:00.000Z",
  "data": {
    "challenge": "synthetic_verification_challenge"
  }
}

Your response

Return HTTP 200 with the exact challenge from the verified request body.

{
  "challenge": "synthetic_verification_challenge"
}

These payloads are synthetic examples.