> ## Documentation Index > Fetch the complete documentation index at: https://docs.powerdialer.ai/llms.txt > Use this file to discover all available pages before exploring further. # Verify a webhook receiver > Prove that the configured receiver can authenticate and acknowledge PowerDialer requests, then enable the subscription. Requires `webhooks:manage` and the owning credential. Configure the signing secret in your receiver before calling this endpoint; no request body is needed. PowerDialer sends a signed JSON challenge of type `webhook.verification`. Verify `PowerDialer-Signature` against the raw bytes and return a 2xx JSON response echoing the identical `challenge` within 15 seconds. A successful response here is `{verified:true,active:true}`. HTTPS public destinations are required; redirects are not followed. `422 verification_failed` means the receiver did not return the expected successful challenge response. Correct the handler before explicitly trying again. `409 configuration_changed` means configuration changed during verification; verify the latest settings. `400 unsafe_receiver` requires a public destination; DNS failures or timeouts can return `503`. This operation has no idempotency receipt and should not be automatically retried after an uncertain response. See [signature verification](/guides/webhooks#verify-signatures-before-parsing). ## OpenAPI ````yaml /api/openapi.json post /webhooks/{id}/verify openapi: 3.1.0 info: title: PowerDialer API v2 version: 2.0.0 description: >- Connect your CRM, sales workspace or reporting tools to PowerDialer using scoped API keys. Manage contacts and calling lists, read call evidence and analytics, and receive signed events. All example records and IDs are synthetic; replace them with values from your workspace. Shared-key v1 is retired. API availability was verified on 2026-10-08; see /availability for historical data coverage. Legacy outbound webhooks use a separate contract. servers: - url: https://api.migration.powerdialer.ai/api/public/v2 description: Production API v2; availability verified on 2026-10-08. security: - ApiKey: [] tags: - name: Authentication - name: Contacts - name: Calling lists - name: Imports - name: Calls - name: Synchronization - name: Analytics - name: Webhooks - name: Webhook deliveries - name: Incoming webhook payloads paths: /webhooks/{id}/verify: post: tags: - Webhooks summary: Verify a webhook receiver description: >- Prove that the configured receiver can authenticate and acknowledge PowerDialer requests, then enable the subscription. Requires `webhooks:manage` and the owning credential. Configure the signing secret in your receiver before calling this endpoint; no request body is needed. PowerDialer sends a signed JSON challenge of type `webhook.verification`. Verify `PowerDialer-Signature` against the raw bytes and return a 2xx JSON response echoing the identical `challenge` within 15 seconds. A successful response here is `{verified:true,active:true}`. HTTPS public destinations are required; redirects are not followed. `422 verification_failed` means the receiver did not return the expected successful challenge response. Correct the handler before explicitly trying again. `409 configuration_changed` means configuration changed during verification; verify the latest settings. `400 unsafe_receiver` requires a public destination; DNS failures or timeouts can return `503`. This operation has no idempotency receipt and should not be automatically retried after an uncertain response. See [signature verification](/guides/webhooks#verify-signatures-before-parsing). operationId: postWebhooksByIdVerify parameters: - name: id in: path required: true schema: type: string format: uuid description: >- Subscription UUID returned by registration or listing. It must belong to the credential making this request. example: 00000000-0000-4000-8000-000000000001 responses: '200': description: >- The receiver echoed the signed challenge successfully and the subscription was enabled. headers: X-Request-Id: schema: type: string format: uuid RateLimit-Limit: schema: type: integer RateLimit-Remaining: schema: type: integer content: application/json: schema: $ref: '#/components/schemas/WebhookVerified' example: verified: true active: true default: description: >- Error. 400 invalid request; 401 invalid credential; 403 insufficient access; 404 not found; 409 state/idempotency conflict; 413 size limit; 422 verification failure; 429 rate limit (Retry-After seconds); 503 temporary service failure. headers: Retry-After: schema: type: integer X-Request-Id: schema: type: string format: uuid content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: invalid_api_key message: API key is invalid, expired or revoked requestId: 00000000-0000-4000-8000-000000000004 x-codeSamples: - lang: bash label: cURL source: >- # Replace example resource IDs and ownerId with values from your workspace. : "${POWERDIALER_API_KEY:?Set POWERDIALER_API_KEY to your scoped API key}" curl --request POST \ --url 'https://api.migration.powerdialer.ai/api/public/v2/webhooks/00000000-0000-4000-8000-000000000001/verify' \ --header "Authorization: Bearer $POWERDIALER_API_KEY" components: schemas: WebhookVerified: type: object properties: verified: const: true description: >- True when the receiver returned the expected signed challenge response. active: const: true description: True when verification enabled delivery. required: - verified - active examples: - verified: true active: true Error: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable error code. message: type: string description: Human-readable explanation. requestId: type: string format: uuid description: Request identifier to include when investigating a failure. details: type: array items: type: object properties: path: type: string message: type: string required: - path - message description: Validation errors, when available. required: - code - message - requestId required: - error examples: - error: code: insufficient_scope message: Requires contacts:read requestId: 00000000-0000-4000-8000-000000000004 securitySchemes: ApiKey: type: http scheme: bearer bearerFormat: pd__. description: >- Issued in Developers. Workspace/owner/scopes come from credential, never acting-user headers. API keys cannot manage API credentials. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.