Connect your website to SDHub.

1. Publish request

When a story is published, the body below is sent to your site's address. «section» and «slot» come from the mapping in SDHub Settings › Website › Sections; when empty, the story goes into its section chronologically. «featured_image_caption» and «ic_gorseller[].aciklama» carry the agency's photo caption (when present; whether to show it on your site is your decision). «editor_kaynak» is for editors only: it shows which source the story came from and is not meant to be published.

POST https://siteniz.com/sdhub-alici
Content-Type: application/json; charset=utf-8
X-SDHub-Timestamp: 1792929600
X-SDHub-Id: 3f9c…(32 hex)
X-SDHub-Signature-V2: v2=<HMAC-SHA256(timestamp.id.body, secret)>
X-SDHub-Signature: sha256=<HMAC-SHA256(body, secret)>

{
  "title": "…", "content": "<p>…</p>", "excerpt": "…",
  "featured_image": "https://…", "images": ["https://…"], "video_url": "",
  "featured_image_data": "…base64…", "featured_image_name": "haber.jpg", "featured_image_type": "image/jpeg",
  "featured_image_caption": "…",
  "ic_gorseller": [{"sira": 1, "data": "…base64…", "name": "ic-1.jpg", "type": "image/jpeg", "kaynak": "https://…", "aciklama": "…"}],
  "ic_foto_yeri": "galeri",
  "documents": [], "tags": ["…"], "categories": ["Gündem"],
  "source": "…", "source_url": "https://…", "editor_kaynak": "AA", "account_id": "…",
  "status": "publish", "section": "Manşet", "slot": "3",
  "timestamp": "2026-10-20T12:00:00"
}

200 / 201  {"ok": true, "url": "https://siteniz.com/haber/…"}

2. Signature and security

If a secret key is set in SDHub, every request is signed. If Bearer or X-API-Key authentication is chosen, that header is sent instead of the signature. SDHub does not follow redirects (3xx): your address must answer the request directly.

SIGNATURE v2 (recommended):
expected = "v2=" + HMAC_SHA256(secret_key, X-SDHub-Timestamp + "." + X-SDHub-Id + "." + raw_body)   // hex
if constant-time compare(expected, X-SDHub-Signature-V2) fails → 401
if |now − X-SDHub-Timestamp| > 300 s → 401   (against replays)
if the same X-SDHub-Id arrives again within 24 hours → do NOT write a new record; return the first record's URL

LEGACY v1 (sent during the transition):
expected = "sha256=" + HMAC_SHA256(secret_key, raw_body)
if constant-time compare(expected, X-SDHub-Signature) fails → 401

Keep the secret OUTSIDE the web root (environment variable or a file outside it); never in a theme file.

If you use PHP: at least 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (21 Oct 2026 security release, CVE-2026-109618/109619);
for the not-yet-patched CVE-2026-115560 set session.upload_progress.enabled=0 in php.ini; hide the version: expose_php=Off

3. Sections, slots and zones

If your site's address answers this request, sections arrive with their slots and zones automatically once «Test connection» succeeds in SDHub. The site must not write any record for this request. Limits: name up to 80, category up to 120, zone up to 60 characters; slots an integer 0–100 (0 = no slot).

{"islem": "bolumler", "account_id": "…", "timestamp": "2026-10-20T12:00:00"}

200  {"ok": true, "sections": [
  {"name": "Manşet", "category": "Gündem", "slots": 10, "zone": "hero"},
  {"name": "Spor",   "category": "Spor",   "slots": 0,  "zone": ""}
]}

4. Categories and connection test

{"islem": "kategoriler", …}  →  200 {"ok": true, "categories": [{"name": "Gündem", "slug": "gundem"}]}
{"test": true, …}               →  200 {"ok": true}   (kayıt yazılmaz / no record is written)

On WordPress and Ghost sites, categories (tags on Ghost) are fetched by SDHub automatically; sections, slots and zones are entered manually.