Signed Request

import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.time.ZoneOffset;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Base64;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class App {

    public static void main(String[] args) throws NoSuchAlgorithmException, InvalidKeyException, IOException, InterruptedException {
        var applicationKey = "";
        var applicationSecret = "";
        var b64DecodedApplicationSecret = Base64.getDecoder().decode(applicationSecret);

        var toNumber = "";

        var sinchVerificationUrl = "https://verificationapi-v1.sinch.com/verification/v1/verifications";

        var verificationRequest = """
            {
                "identity": {
                  "type": "number",
                  "endpoint": "%s"
                  },
                  "method": "sms"
                }
            }
            """.formatted(toNumber);
        
        byte[] encodedVerificationRequest = verificationRequest.getBytes(StandardCharsets.UTF_8);

        MessageDigest md = MessageDigest.getInstance("MD5");
        md.update(encodedVerificationRequest);
        var encodedMd5ToBase64VerificationRequest = Base64.getEncoder().encode(md.digest());
        
        var httpVerb = "POST";
        var requestContentType = "application/json; charset=UTF-8";
        var timeNow = ZonedDateTime.now(ZoneOffset.UTC).format(DateTimeFormatter.ISO_INSTANT);
        var requestTimeStamp = "x-timestamp:" + timeNow;
        var requestUriPath = "/verification/v1/verifications";

        var stringToSign = String.join(System.lineSeparator()
            , httpVerb
            , new String(encodedMd5ToBase64VerificationRequest, StandardCharsets.UTF_8)
            , requestContentType
            , requestTimeStamp
            , requestUriPath
        );

        SecretKeySpec secretKeySpec = new SecretKeySpec(b64DecodedApplicationSecret, "HmacSHA256");
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(secretKeySpec);
        byte[] hmacSha256 = mac.doFinal(stringToSign.getBytes());

        var authorizationSiganture = new String(Base64.getEncoder().encode(hmacSha256), StandardCharsets.UTF_8);

        var httpClient = HttpClient.newBuilder().build();

        var request = HttpRequest.newBuilder()
            .POST(HttpRequest.BodyPublishers.ofString(verificationRequest))
            .uri(URI.create(sinchVerificationUrl))
            .header("Content-Type", requestContentType)
            .header("Authorization", "Application " + applicationKey + ":" + authorizationSiganture)
            .header("x-timestamp", timeNow)
            .build();

        var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

import hashlib
import hmac
import base64
from datetime import datetime, timezone
import requests
import json

applicationKey = ''
applicationSecret = ''
b64DecodedApplicationSecret = base64.b64decode(applicationSecret)

toNumber = ''

sinchVerificationUrl = "https://verificationapi-v1.sinch.com/verification/v1/verifications"

verificationRequest = {
  "identity": {
    "type": "number",
    "endpoint": toNumber
    },
    "method": "sms"
  }
}

encodedVerificationRequest = json.dumps(verificationRequest).encode()
md5VerificationRequest = hashlib.md5(encodedVerificationRequest)
encodedMd5ToBase64VerificationRequest = base64.b64encode(md5VerificationRequest.digest())

httpVerb = 'POST'
requestContentType = 'application/json; charset=UTF-8'
timeNow = datetime.now(timezone.utc).isoformat()
requestTimeStamp = "x-timestamp:" + timeNow
requestUriPath = '/verification/v1/verifications'

stringToSign = (httpVerb + "\n"
    + encodedMd5ToBase64VerificationRequest.decode() + "\n"
    + requestContentType + "\n"
    + requestTimeStamp + "\n"
    + requestUriPath)

authorizationSignature = base64.b64encode(hmac.new(b64DecodedApplicationSecret, stringToSign.encode(), hashlib.sha256).digest()).decode()

headers = { 
    "Content-Type": requestContentType,
    "Authorization": (f"Application {applicationKey}:{authorizationSignature}"),
    "x-timestamp": timeNow
    }

response = requests.post(sinchVerificationUrl, json=verificationRequest, headers=headers)

data = response.json()
print(data)

<?php

declare(strict_types=1);

$applicationKey = "";
$applicationSecret= "";
$b64DecodedApplicationSecret = base64_decode($applicationSecret, true);

$toNumber = "";

$sinchVerificationUrl = "https://verificationapi-v1.sinch.com/verification/v1/verifications";

$verificationRequest = [
  "identity" => [
    "type" => "number",
    "endpoint" => $toNumber
    ],
    "method" => "sms"
  ]
];

$encodedVerificationRequest = utf8_encode(json_encode($verificationRequest, JSON_UNESCAPED_UNICODE));
$md5VerificationRequest = md5($encodedVerificationRequest, true);
$encodedMd5ToBase64VerificationRequest = base64_encode($md5VerificationRequest);

$httpVerb = 'POST';
$requestContentType = 'application/json; charset=UTF-8';
date_default_timezone_set('UTC');
$timeNow = date(DateTime::ATOM);
$requestTimeStamp = "x-timestamp:" . $timeNow;
$requestUriPath = "/verification/v1/verifications/";

$stringToSign = $httpVerb . "\n"
    . $encodedMd5ToBase64VerificationRequest . "\n"
    . $requestContentType . "\n"
    . $requestTimeStamp . "\n"
    . $requestUriPath;

$authorizationSignature = base64_encode(hash_hmac("sha256", $stringToSign, $b64DecodedApplicationSecret, true));

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_HTTPHEADER => [
    "Content-Type: {$requestContentType}",
    "x-timestamp: {$timeNow}",
    "Authorization: Application {$applicationKey}:{$authorizationSignature}"
  ],
  CURLOPT_POSTFIELDS => json_encode($verificationRequest),
  CURLOPT_URL => $sinchVerificationUrl,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => $httpVerb,
]);

$response = curl_exec($curl);
$error = curl_error($curl);

curl_close($curl);

echo $response;