cURL

Every endpoint page includes a signed cURL example. Sign inbound calls with the API secret (placeholder YOUR_API_SECRET).

TS=$(date +%s)
RAW=''
SIG=$(printf '%s' "${TS}.${RAW}" | openssl dgst -sha256 -hmac "YOUR_API_SECRET" | awk '{print $2}')
curl -sS -X GET "https://api.restrosync.com/v1/integrations/YOUR_INTEGRATION_ID/capabilities" \
  -H "X-ROS-Timestamp: $TS" \
  -H "X-ROS-Signature: sha256=$SIG" \
  -H "X-ROS-Key-Id: YOUR_API_KEY" \
  -H "X-ROS-Event-Id: evt_demo"

GET capabilities/health sign an empty body. Mutating calls sign the exact JSON bytes. The Postman variable api_secret is still named YOUR_WEBHOOK_SECRET as a placeholder — inbound HMAC uses the API secret.