# Posiway API orientation

The Posiway developer interface includes a REST API, a machine-readable OpenAPI specification, and signed webhook delivery for event-driven integrations.

## Start here

- Interactive reference: https://www.posiway.com/docs/api/
- OpenAPI JSON: https://www.posiway.com/api/openapi.json
- Integration guides: https://www.posiway.com/docs/guides/
- Webhook protocol: https://www.posiway.com/docs/guides/webhook-api
- Alarm events: https://www.posiway.com/docs/guides/webhook-alarm-events

## Webhook behavior

Webhook requests use JSON and include event ID, event type, timestamp, signature version, and HMAC-SHA256 signature headers. Consumers should verify the signature against the raw request body, use the event ID as an idempotency key, return a 2xx status for accepted or already-processed events, and process long-running work asynchronously.

The OpenAPI specification is the authoritative source for currently documented REST endpoints and schemas. Authentication credentials and production access are provided through the Posiway onboarding process.