Webhook Configuration — Creating Subscriptions. Webhook endpoints are managed via the /webhooks REST API. To create a new subscription, send a POST request to /webhooks with a JSON body containing the following fields: url (the HTTPS endpoint that will receive event payloads — HTTP URLs are rejected), secret (a shared secret of at least 32 characters used to compute HMAC-SHA256 signatures for payload verification), events (an array of event types to subscribe to, such as "document.created", "document.indexed", "query.completed"), and metadata (optional key-value pairs for your own reference). Each webhook endpoint is assigned a unique ID upon creation. You may create up to 20 webhook subscriptions per project. Event payloads are delivered as HTTP POST requests with a JSON body containing the event type, timestamp, and a data object specific to the event. The X-Webhook-Signature header contains the HMAC-SHA256 hex digest of the raw request body, computed using your shared secret. Always verify this signature before processing the payload.