GET Capabilities

GET /v1/integrations/{integrationId}/capabilities

Capabilities

Authentication

HMAC-SHA256 over timestamp + "." + rawBody. Headers: X-ROS-Signature, X-ROS-Timestamp, X-ROS-Event-Id, X-ROS-Key-Id. Replay window 5 minutes.

Required scope

HMAC discovery — not a grantable scope — Do not request capabilities.read or health.read. Sign the empty GET body.

Headers

Path parameters

Query parameters

None on this path.

Request body

Empty. Sign the empty string as the raw body.

Example request

TS=$(date +%s)
RAW=''
SIG=$(printf '%s' "${TS}.${RAW}" | openssl dgst -sha256 -hmac "$ROS_API_SECRET" | awk '{print $2}')
curl -sS -X GET "https://api.restrosync.com/v1/integrations/$INTEGRATION_ID/capabilities" \
  -H "X-ROS-Timestamp: $TS" \
  -H "X-ROS-Signature: sha256=$SIG" \
  -H "X-ROS-Key-Id: $KEY_ID" \
  -H "X-ROS-Event-Id: $EVENT_ID"

const crypto = require('crypto');
const raw = '';
const ts = Math.floor(Date.now() / 1000).toString();
const sig = crypto.createHmac('sha256', process.env.ROS_API_SECRET).update(ts + '.' + raw).digest('hex');

import hmac, hashlib, time
raw = b''
ts = str(int(time.time()))
sig = hmac.new(secret, (ts + '.' + (raw.decode() if raw else '')).encode(), hashlib.sha256).hexdigest()

Response

{
  "success": true,
  "data": {}
}

Errors

Typical: SIGNATURE_INVALID (401), RATE_LIMITED (429). Catalogue: errors.

{
  "success": false,
  "error": {
    "code": "SIGNATURE_INVALID",
    "message": "Invalid signature",
    "requestId": "req_demo"
  }
}

Idempotency

GET discovery is not idempotent-keyed. Do not send a body.

Retry behavior

Retry 5xx / 429 with the same idempotency key. Do not retry 4xx signature, schema, or duplicate conflicts.