Signed Request

import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.time.ZoneOffset;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Base64;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class App {

    public static void main(String[] args) throws NoSuchAlgorithmException, InvalidKeyException, IOException, InterruptedException {
        var applicationKey = "";
        var applicationSecret = "";
        var b64DecodedApplicationSecret = Base64.getDecoder().decode(applicationSecret);

        var fromNumber = "";
        var toNumber = "";

        var sinchVoiceUrl = "https://calling.api.sinch.com/calling/v1/callouts";

        var calloutRequest = """
            {
                "method": "ttsCallout",
                "ttsCallout": {
                  "cli": "%s",
                  "destination": {
                    "type": "number",
                    "endpoint": "%s"
                  },
                  "locale": "en-US",
                  "text": "Hello, this is a call from Sinch. Congratulations! You made your first call."
                }
            }
            """.formatted(fromNumber, toNumber);
        
        byte[] encodedCalloutRequest = calloutRequest.getBytes(StandardCharsets.UTF_8);

        MessageDigest md = MessageDigest.getInstance("MD5");
        md.update(encodedCalloutRequest);
        var encodedMd5ToBase64CalloutRequest = Base64.getEncoder().encode(md.digest());
        
        var httpVerb = "POST";
        var requestContentType = "application/json; charset=UTF-8";
        var timeNow = ZonedDateTime.now(ZoneOffset.UTC).format(DateTimeFormatter.ISO_INSTANT);
        var requestTimeStamp = "x-timestamp:" + timeNow;
        var requestUriPath = "/calling/v1/callouts";

        var stringToSign = String.join(System.lineSeparator()
            , httpVerb
            , new String(encodedMd5ToBase64CalloutRequest, StandardCharsets.UTF_8)
            , requestContentType
            , requestTimeStamp
            , requestUriPath
        );

        SecretKeySpec secretKeySpec = new SecretKeySpec(b64DecodedApplicationSecret, "HmacSHA256");
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(secretKeySpec);
        byte[] hmacSha256 = mac.doFinal(stringToSign.getBytes());

        var authorizationSiganture = new String(Base64.getEncoder().encode(hmacSha256), StandardCharsets.UTF_8);

        var httpClient = HttpClient.newBuilder().build();

        var request = HttpRequest.newBuilder()
            .POST(HttpRequest.BodyPublishers.ofString(calloutRequest))
            .uri(URI.create(sinchVoiceUrl))
            .header("content-type", requestContentType)
            .header("authorization", "application " + applicationKey + ":" + authorizationSiganture)
            .header("x-timestamp", timeNow)
            .build();

        var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

import hashlib
import hmac
import base64
from datetime import datetime, timezone
import requests
import json

applicationKey = ''
applicationSecret = ''
b64DecodedApplicationSecret = base64.b64decode(applicationSecret)

fromNumber = ''
toNumber = ''

sinchVoiceUrl = "https://calling.api.sinch.com/calling/v1/callouts"

calloutRequest = {
  "method": "ttsCallout",
  "ttsCallout": {
    "cli": fromNumber,
    "destination": {
      "type": "number",
      "endpoint": toNumber
    },
    "locale": "en-US",
    "text": "Hello, this is a call from Sinch. Congratulations! You made your first call."
  }
}

encodedCalloutRequest = json.dumps(calloutRequest).encode()
md5CalloutRequst = hashlib.md5(encodedCalloutRequest)
encodedMd5ToBase64CalloutRequest = base64.b64encode(md5CalloutRequst.digest())

httpVerb = 'POST'
requestContentType = 'application/json; charset=UTF-8'
timeNow = datetime.now(timezone.utc).isoformat()
requestTimeStamp = "x-timestamp:" + timeNow
requestUriPath = '/calling/v1/callouts'

stringToSign = (httpVerb + "\n"
    + encodedMd5ToBase64CalloutRequest.decode() + "\n"
    + requestContentType + "\n"
    + requestTimeStamp + "\n"
    + requestUriPath)

authorizationSignature = base64.b64encode(hmac.new(b64DecodedApplicationSecret, stringToSign.encode(), hashlib.sha256).digest()).decode()

headers = { 
    "content-type": requestContentType,
    "authorization": (f"application {applicationKey}:{authorizationSignature}"),
    "x-timestamp": timeNow
    }

response = requests.post(sinchVoiceUrl, json=calloutRequest, headers=headers)

data = response.json()
print(data)

<?php

declare(strict_types=1);

$applicationKey = "";
$applicationSecret= "";
$b64DecodedApplicationSecret = base64_decode($applicationSecret, true);

$toNumber = "";
$fromNumber = "";

$sinchVoiceUrl = "https://calling.api.sinch.com/calling/v1/callouts";

$calloutRequest = [
  "method" => "ttsCallout",
  "ttsCallout" => [
    "cli" => $fromNumber,
    "destination" => [
      "type" => "number",
      "endpoint" => $toNumber
    ],
    "locale" => "en-US",
    "text" => "Hello, this is a call from Sinch. Congratulations! You made your first call."
  ]
];

$encodedCalloutRequest = utf8_encode(json_encode($calloutRequest, JSON_UNESCAPED_UNICODE));
$md5CalloutRequest = md5($encodedCalloutRequest, true);
$encodedMd5ToBase64CalloutRequest = base64_encode($md5CalloutRequest);

$httpVerb = 'POST';
$requestContentType = 'application/json; charset=UTF-8';
date_default_timezone_set('UTC');
$timeNow = date(DateTime::ATOM);
$requestTimeStamp = "x-timestamp:" . $timeNow;
$requestUriPath = "/calling/v1/callouts/";

$stringToSign = $httpVerb . "\n"
    . $encodedMd5ToBase64CalloutRequest . "\n"
    . $requestContentType . "\n"
    . $requestTimeStamp . "\n"
    . $requestUriPath;

$authorizationSignature = base64_encode(hash_hmac("sha256", $stringToSign, $b64DecodedApplicationSecret, true));

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_HTTPHEADER => [
    "content-type: {$requestContentType}",
    "x-timestamp: {$timeNow}",
    "authorization: application {$applicationKey}:{$authorizationSignature}"
  ],
  CURLOPT_POSTFIELDS => json_encode($calloutRequest),
  CURLOPT_URL => $sinchVoiceUrl,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => $httpVerb,
]);

$response = curl_exec($curl);
$error = curl_error($curl);

curl_close($curl);

echo $response;