Create the webhook or change its url and event_types (["*"] by default: *, exact types such as booking.confirmed, or families such as booking.*; at most 50). Creating it answers 201 with its signing secret (whsec_...), shown this once: store it. A change answers 200 and no secret. The URL must be https on port 443, with no user name, password or fragment, at most 2,048 characters, and a public host name (not an IP address, a local name or a DJfindr host) whose every address is public; it is checked again before every delivery. A refused URL is 422 on fields.url. Answered with Cache-Control: no-store. Takes no Idempotency-Key (one sent is ignored): repeating it is safe by itself.