signing_secret is returned once — store it immediately. It cannot be retrieved again (only rotated).events is omitted, all available events are subscribed by default.curl --location '/webhooks' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
"name": "Production Handler",
"url": "https://your-server.com/webhooks/tdta",
"events": [
"booking.created",
"booking.confirmed",
"booking.cancelled"
],
"timeout_seconds": 10
}'{
"id": 3,
"name": "Production Handler",
"url": "https://your-server.com/webhooks/tdta",
"events": [
"booking.created",
"booking.confirmed",
"booking.cancelled"
],
"is_active": true,
"timeout_seconds": 10,
"secret_prefix": "tdtaXyZ1abcd••••••••••••••••••••",
"last_delivered_at": null,
"last_response_code": null,
"consecutive_failures": 0,
"created_at": "2026-06-05T10:00:00+00:00",
"signing_secret": "tdtaXyZ1abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstu",
"signing_secret_notice": "Store this secret safely — it will not be shown again."
}