GET/api/intake/webhooks

Returns { webhooks: [{ id, url, events, active, description, created_at }], events: [all event names] }.

POST/api/intake/webhooks

Body: { url (https), events? (default ["*"]), description? }. 201 with secret, shown once. 400 bad url or unknown event; 409 at 10 per key.

POST/api/intake/webhooks/{id}/test

Send a ping now. 200 { delivered: true, delivery } or 502 with the status your server returned.

DELETE/api/intake/webhooks/{id}

Headers on every delivery: X-Glyph-Event, X-Glyph-Delivery, X-Glyph-Signature (t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">). Retries after 1m, 5m, 30m, 2h, 12h.