Register a signed webhook destination for this tenant

Registers an HTTPS destination and the versioned events it should receive, and mints the HMAC signing secret. The secret is returned EXACTLY ONCE, in this response: the API's database role holds no read privilege on the column that stores it, so it cannot be retrieved later by any route. A replay of the same Idempotency-Key answers 200 with replay=true and no secret. Destinations are admitted by an anti-SSRF gate: https only, default port only, no credentials in the URL, no fragment, and the host must be a public DNS name whose last label is alphabetic, which refuses every IP literal in every base as well as localhost, .internal, .local and cloud metadata names.

curl -X POST "https://example.com/api/v2/webhooks/subscriptions" \  -H "Idempotency-Key: b6a2f0e4-1c3d-4a5b-8e7f-9d0c1b2a3e4f" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "url": "https://webhooks.example.com/apifact",    "events": [      "document.validated",      "document.submitted",      "document.accepted",      "document.observed",      "document.rejected",      "document.ambiguous",      "document.failed",      "document.pdf_ready"    ]  }'

{  "subscriptionId": "d079718b-ff63-45dd-947b-4950c023750f",  "url": "http://example.com",  "events": [    "document.accepted"  ],  "status": "ACTIVE",  "description": "string",  "secretVersion": 1,  "createdAt": "2019-08-24T14:15:22Z",  "updatedAt": "2019-08-24T14:15:22Z",  "schemaVersion": "2.0",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "resourceId": "026d60bb-63a8-407e-bf67-01dcfc6022e6",  "replay": true}