---
title: "Verify webhook signature"
method: POST
path: "/v1/notifications/verify-webhook-signature"
tags: ["verify-webhook-signature"]
---

# Verify webhook signature

`POST /v1/notifications/verify-webhook-signature`

Verifies a webhook signature.

## Request body

- VerifyWebhookSignature — A verify webhook signature request.
  - `auth_algo` string, required — The algorithm that PayPal uses to generate the signature and that you can use to verify the signature. Extract this value from the `PAYPAL-AUTH-ALGO` response header, which is received with the webhook notification.
  - `cert_url` string, uri, required — The X.509 public key certificate. Download the certificate from this URL and use it to verify the signature. Extract this value from the `PAYPAL-CERT-URL` response header, which is received with the webhook notification.
  - `transmission_id` string, required — The ID of the HTTP transmission. Contained in the `PAYPAL-TRANSMISSION-ID` header of the notification message.
  - `transmission_sig` string, required — The PayPal-generated asymmetric signature. Appears in the `PAYPAL-TRANSMISSION-SIG` header of the notification message.
  - `transmission_time` string, date-time, required — The date and time of the HTTP transmission, in [Internet date and time format](https://tools.ietf.org/html/rfc3339#section-5.6). Appears in the `PAYPAL-TRANSMISSION-TIME` header of the notification message.
  - `webhook_id` string, required — The ID of the webhook as configured in your Developer Portal account.
  - `webhook_event` Event, required — A webhook event notification.
    - `id` string — The ID of the webhook event notification.
    - `create_time` string, date-time — The date and time when the webhook event notification was created, in [Internet date and time format](https://tools.ietf.org/html/rfc3339#section-5.6).
    - `resource_type` string — The name of the resource related to the webhook notification event.
    - `event_version` string — The event version in the webhook notification.
    - `event_type` string — The event that triggered the webhook event notification.
    - `summary` string — A summary description for the event notification.
    - `resource_version` string — The resource version in the webhook notification.
    - `resource` Resource — The resource that triggered the webhook event notification.
    - `links` LinkDescription[] — An array of request-related [HATEOAS links](/docs/api/reference/api-responses/#hateoas-links).
      - `href` string, required — The complete target URL. To make the related call, combine the method with this [URI Template-formatted](https://tools.ietf.org/html/rfc6570) link. For pre-processing, include the `$`, `(`, and `)` characters. The `href` is the key HATEOAS component that links a completed call with a subsequent call.
      - `rel` string, required — The [link relation type](https://tools.ietf.org/html/rfc5988#section-4), which serves as an ID for a link that unambiguously describes the semantics of the link. See [Link Relations](https://www.iana.org/assignments/link-relations/link-relations.xhtml).
      - `method` 'GET' | 'POST' | 'PUT' | 'DELETE' | 'HEAD' | 'CONNECT' | 'OPTIONS' | 'PATCH' — The HTTP method required to make the related call.

## Response `200`

A successful request returns the HTTP `200 OK` status code and a JSON response body that shows the verification status.

- VerifyWebhookSignatureResponse — The verify webhook signature response.
  - `verification_status` 'SUCCESS' | 'FAILURE', required — The status of the signature verification.

## Other responses

- `default` — The error response.

---

[API](https://skmtc.net/paypal/apis/payments.md) · [All operations](https://skmtc.net/paypal/apis/payments/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/paypal/payments/versions/672aceee1190/schema)