Create a webhook. The success response returns its ID and secret_token once, with Cache-Control: no-store. Existing webhooks cannot retrieve their secret through the API. On application disconnect, Hostex deletes only webhooks created by that application for that account and sends a final authorization_revoked notification to their saved endpoints, even if their events filter excludes it. Manual webhooks and other applications are unaffected. See the Webhook Usage Guide for delivery limits. Every v3 event payload includes a string ULID event_id shared across all URLs and retries for the same event; use it to deduplicate notifications.