---
title: "Verify Webhook Notification"
method: POST
path: "/api/v2/webhook/{webhookId}/verify"
tags: ["Webhook"]
---

# Verify Webhook Notification

`POST /api/v2/webhook/{webhookId}/verify`

Verify that a webhook notification comes from BitGo based on webhook signature and payload.
If the X-Signature-SHA256 header is absent from the notification, use the [Create webhook secret](/reference/v2webhooksecretcreate#/) endpoint to generate a secret for your enterprise or organization.
The requester must be an admin of the specified enterprise or organization.

## Path parameters

- `webhookId` string, required

## Request body

- object
  - `signature` string, required — Webhook notification signature calculated based on the payload and webhook secret. Found in the HTTP header X-Signature-SHA256 of the notification.
  - `notificationPayload` string, required — Webhook notification payload as JSON string

## Response `200`

OK

- VerifyWebhookNotificationResponse
  - `webhookId` string, required
  - `isValid` boolean, required

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.net/bitgo/apis/bitgo-api.md) · [All operations](https://skmtc.net/bitgo/apis/bitgo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bitgo/bitgo-api/revisions/e445c15e5bee/schema)