integrations/sdk/postman/slk-invoices.postman_collection.json is a Postman collection (v2.1) with a request for every endpoint.
Import#
- Postman → Import → choose the JSON file (or import the OpenAPI document from
https://invoice.slk.co.il/api/billing/v1/openapi.jsonfor a generated collection). - Open the collection's Variables tab and set:
| Variable | Set to |
|---|---|
baseUrl | Origin only, e.g. https://invoice.slk.co.il (no trailing slash, no /api/billing/v1) |
apiKey | Your API key. The Sandbox → Open a developer sandbox request fills it in for you |
invoiceId | Filled automatically by the create-document tests; used by the receipt, credit-note and "Get one document" requests |
source, hookId | Connector id and the 32-hex hook id for the receiver request |
connectorSecret | The signing secret you saved for that connector (Shopify: the webhook signing secret) |
webhookTarget, webhookSecret | Your own webhook URL and its signing secret, for the signing simulation |
tenantId | Your tenant id (from the sandbox response) |
What is in it#
| Folder | Requests |
|---|---|
| Documents | Create: invoice-receipt (native), Invoice4U-compatible, receipt against an invoice, credit note, donation receipt · List · Get one |
| Customers | List · Create |
| Calculate | Mixed-VAT basket |
| Sandbox | Open a developer sandbox (saves apiKey, tenantId, hookId from the response) |
| Connectors | Inbound receiver with a signed Shopify orders/paid sample |
| Webhooks | Simulate a signed delivery to your own endpoint |
| MCP | tools/list |
| Meta | The OpenAPI document |
Authenticated requests carry X-Api-Key: {{apiKey}}; the Invoice4U-compatible request carries the key in the body token instead. Bodies use realistic Hebrew data and apiIdentifier: order-{{$timestamp}}, so each send creates a new document; send a fixed identifier to see idempotency.
Verifying webhooks from Postman#
The Webhooks → Simulate a signed webhook delivery request POSTs a document.issued envelope to {{webhookTarget}} and its pre-request script signs the body the way SLK does:
const secret = pm.collectionVariables.get('webhookSecret');
const body = pm.request.body.raw; // sent verbatim: the signature covers exactly these bytes
const t = Math.floor(Date.now() / 1000);
const v1 = CryptoJS.HmacSHA256(`${t}.${body}`, secret).toString(CryptoJS.enc.Hex);
pm.request.headers.upsert({ key: 'X-SLK-Signature', value: `t=${t},v1=${v1}` });Point it at your local handler (through a tunnel) to check your verification code before real events arrive. Do not edit the body after the script has signed it, and keep Postman's "automatically format body" options off so the raw text is not re-serialised. The signature scheme is documented in webhooks.
The Shopify sample in the Connectors folder uses the same idea with Shopify's scheme: base64 HMAC-SHA256(secret, rawBody) in X-Shopify-Hmac-Sha256.