Set (or rotate) the caller's outbound webhook endpoint
One WebhookEndpoint row per user. First call creates it and returns a server-generated secret in plaintext (the only time it is ever shown again). A later call without rotateSecret just updates url; rotateSecret: true moves the current secret into secondarySecret (kept valid for a grace window) and mints a fresh secret. Deliveries carry X-Vyomflow-Signature: sha384=<hex(HMAC_SHA384(, secret))>, X-Vyomflow-Timestamp, X-Vyomflow-Event-Id, and X-Vyomflow-Delivery-Attempt for agent.started/agent.completed/agent.failed/tool.completed events.
Authorizations
Clerk session token, Authorization: Bearer <token> — the first-party browser app's own auth. Used only by this internal /api/v1/* surface, never by /api/public/v1/*.