HTTP method; upper-cased internally (e.g. "POST").
Request path INCLUDING query string, exactly as sent (e.g. /v1/balances?quote=USDT).
Timestamp string (epoch milliseconds) that also goes in the timestamp header.
Unique single-use value (e.g. a UUID) that also goes in the nonce header.
Raw request body string; empty string "" for bodyless requests.
The newline-joined canonical string ready to feed into HMAC_SHA512.
Build the canonical string that gets HMAC-signed for a request.
The signature binds the HTTP method + full path (including query) + a SHA-256 hash of the body, so a captured signature cannot be replayed against a different operation or with a tampered body. Exposed mainly for building a custom transport; most callers never need it (the client signs automatically).
Canonical form:
METHOD\npath\ntimestamp\nnonce\nsha256hex(body).