Submit
An onboarded agent sends the allowed method with a payload, timestamp, event/source identifiers and HMAC signature.
B2B API · signed webhooks · technical receipts
Verify webhook signatures.
Get an integrity receipt.
IntegrityPhase checks the HMAC signature, timestamp and payload fingerprint of a submitted webhook event, then returns a machine-readable result. A successful check produces a technical integrity receipt. It does not establish that the underlying event is true, lawful or financially safe.
webhook_integrity.v1
POST /verify/webhook-integrity
Access by B2B onboarding
REQUESTwebhook_integrity.v1payload · timestamp · HMAC
RECEIPT verifiedrequest_id · artifact_hash
One product, one public operation
Signed webhookTimestamp freshnessPayload fingerprintMachine-readable receipt
01
Defined verification flow
From a signed webhook to a bounded technical receipt.
Check
The service applies its method and release policy, compares the HMAC-SHA256 signature, checks timestamp freshness and calculates the payload fingerprint and size.
Receive
The agent receives a structured status plus identifiers and hashes for downstream correlation, artifact lookup and audit.
02
Machine-readable receipt
Enough evidence to trace the check — without claiming more.
A released receipt identifies the method, request and technical artifact. It records the verification status, relevant check results, timestamps and fingerprints. Raw payload content is not part of the public receipt.
“Technical receipt” means the verification artifact returned by the API. It is not a payment receipt or invoice.
- method, request and result status;
- artifact and proof identifiers with hashes;
- signature and timestamp check outcomes;
- payload hash and size for correlation;
- explicit limitations and audit references.
{
"schema_version": "canon.verify_webhook_integrity_response.v1",
"request_id": "req_…",
"status": "verified",
"proof_released": true,
"artifact": {
"method_id": "webhook_integrity.v1",
"artifact_id": "whi_…",
"artifact_hash": "sha256:…",
"evidence": {
"signature_valid": true,
"timestamp_valid": true,
"payload_hash": "sha256:…"
}
}
}03
What is actually checked
A deliberately small verification surface.
IntegrityPhase reports only the checks executed by the configured method. It does not infer the business meaning of the payload.
Allowed operation
The method must be webhook_integrity.v1, and the configured policy must allow a technical artifact to be released.
Signature and freshness
The submitted HMAC-SHA256 signature is compared against the configured secret and signed payload/timestamp. The timestamp must be parseable and within the configured age window.
Payload correlation
The service calculates a canonical payload hash and byte size so the checked input can be correlated without placing raw content in the receipt.
04
Automatic B2B onboarding
From company onboarding to a technical receipt.
The prepared agent uses its existing company authority and wallet through IntegrityPhase MCP, without a mandatory interactive setup. Qualified businesses in the 27 EU countries and supported VAT territories, including sole traders. Each buyer requires sufficient identity, tax and authority evidence. Unresolved qualification stops payment; consumers and private use are excluded.
EU BUSINESSES · 27 COUNTRIES- 01
Discover
Read
GET /.well-known/canon.jsonfor the request contract, eligibility, current availability and payment conditions. - 02
Onboard
Submit company and VAT details, the signed agent declaration and wallet signature through
POST /onboarding/b2b. Accept the exact Terms, Privacy Policy and framework DPA. - 03
Request verification
When paid access is enabled, submit the signed webhook to
POST /verify/webhook-integrityand explicitly authorize the requested payment. Onboarding alone does not authorize spending. - 04
Read the result
Handle verified, failed or inconclusive results according to your policy. Use the receipt identifiers and fingerprints to correlate the technical evidence.
Current sales availability is shown in the live-status panel. This informational site does not register a company, record acceptance or initiate a payment. View the three legal documents, version 1.7.0. The API checks the signed declaration and key control; it relies on declared company authority and does not independently establish representation rights.
05
Explicit product limits
A technical receipt is not a truth certificate.
IntegrityPhase states what its configured checks observed for the submitted bytes and metadata at a specific time. The customer remains responsible for the source, business event and any downstream decision.
A valid signature can link bytes to a configured secret. It does not prove that the represented event occurred or that its content is correct.
01
No guarantee that the underlying event, payload claim or source statement is true.
02
No qualified trust-service status or legal presumptions associated with a qualified service.
03
No guarantee of financial safety, payment finality, creditworthiness or business outcome.
04
No legal, tax, financial, investment, medical or operational recommendation.
05
No custody of customer funds, wallet/private keys or transaction-authorisation secrets and no participation in the customer’s underlying transaction.
06
The scope of each check is defined by the published method contract; a receipt is not a complete security audit of your integration.
06
Operational principles
Small surface. Clear evidence. Fail closed.
Receipt, not payload archive
Public output favors identifiers, timestamps and cryptographic fingerprints over raw customer content.
Linked technical records
Request, proof, artifact, ledger and audit references can be correlated without turning a technical result into a legal claim.
Missing conditions stop release
Missing access, policy, signature, timestamp or release conditions produce a blocked, failed or inconclusive result — not a successful receipt.
07
Integration support
Questions about your integration?
Contact us about the API, privacy or security. Company registration and document acceptance take place through automatic API onboarding.
sales currently disabled
Do not send payloads, API keys, wallet keys, payment signatures or other secrets by e-mail.
Company verification and agent purchases
Qualified businesses in the 27 EU countries and supported VAT territories, including sole traders. Each buyer requires sufficient identity, tax and authority evidence. Unresolved qualification stops payment; consumers and private use are excluded. EUR 20 net per proof plus applicable VAT. USDC on Base uses the current buyer-bound daily quote. A technical proof does not confirm order fulfilment. Sales availability and dated Bazaar observations are separate. Nevermined is OFF.
For Logistics, Warehouse Management, Supply Chain and MRO, an agent receives an order-acceptance, parts-reservation or inventory-update message and buys a signed receipt of HMAC, format and freshness checks. IntegrityPhase is not a warehouse system, confirmation of physical stock or fulfilment, or settlement of another business transaction. The receipt does not prove the real-world event.
Availability and observations
Sales: no current confirmation.
Bazaar: no current observation.
Nevermined: OFF.