HTTP Headers

Key: X-Signature

[!NOTE] Notes To generate an X-signature, you must use the private key, which can be extracted from the certificate you have received.

To ensure the authenticity and integrity of each request, every request must include the X-Signature HTTP header.
The signature is generated as follows:
Take the raw HTTP request body exactly as it is sent to the server (without any modifications).
Sign the request body using the RSASSA-PKCS1-v1_5 signature algorithm with the SHA-256 hash function.
Use the sender's RSA private key to generate the digital signature.
Encode the resulting binary signature using Base64.
Include the Base64-encoded signature in the X-Signature HTTP header.

Pre-request example for Postman:

return (async () => {  
  
 const pem = `-----BEGIN PRIVATE KEY-----  
...............................................  
-----END PRIVATE KEY-----`;  
  
 const b64 = pem  
 .replace(/-----BEGIN PRIVATE KEY-----/, '')  
 .replace(/-----END PRIVATE KEY-----/, '')  
 .replace(/\s+/g, '');  
  
 const binaryDer = Uint8Array.from(atob(b64), c => c.charCodeAt(0));  
  
 const privateKey = await crypto.subtle.importKey(  
 "pkcs8",  
 binaryDer.buffer,  
 {  
 name: "RSASSA-PKCS1-v1_5",  
 hash: "SHA-256"  
 },  
 false,  
 ["sign"]  
 );  
  
 const rawBody = pm.request.body.raw;  
 const encoder = new TextEncoder();  
 const data = encoder.encode(rawBody);  
  
 const signature = await crypto.subtle.sign(  
 "RSASSA-PKCS1-v1_5",  
 privateKey,  
 data  
 );  
  
 const signatureBase64 = btoa(  
 String.fromCharCode(...new Uint8Array(signature))  
 );  
  
 pm.request.headers.upsert({  
 key: "X-Signature",  
 value: signatureBase64  
 });  
  
})();