Webhook endpoints receive signed event deliveries. Ten methods. API detail: Webhooks.
Exactly two replies ever carry the signing secret: create and rotate. Store it then — no read returns it again.
create
POST /v1/webhooks. The reply is the endpoint plus secret — shown once.
list
GET /v1/webhooks, cursor-paginated. No secret on any entry.
get
GET /v1/webhooks/{id}.
update
PATCH /v1/webhooks/{id}. WebhookPatch is { url?, events?, enabled? }.
rotate
POST /v1/webhooks/{id}/rotate, body { overlap_hours } when given. The reply is { id, secret, overlap_expires_at } — the new secret, shown once. Both secrets sign until overlap_expires_at, so a receiver can redeploy without dropping a delivery.
deliveries
GET /v1/webhooks/{id}/deliveries — attempts, statuses, and response codes.
delivery
GET /v1/webhooks/{id}/deliveries/{delivery_id}.
test
POST /v1/webhooks/{id}/test. Sends a webhook.test envelope to the endpoint’s real URL and answers the pending delivery row.
redeliver
POST /v1/webhooks/{id}/deliveries/{delivery_id}/redeliver. Resends a past delivery’s exact envelope — a new attempt, the same evt_ id, so an idempotent receiver stays correct.
delete
DELETE /v1/webhooks/{id}. 
