Registering, updating, deleting and rotating the endpoints Aloha notifies.
A webhook endpoint belongs to the account, not to the API key that registered it. Every operation here reads and writes across the whole account, and an endpoint outlives the key that created it — revoking that key neither deletes the endpoint nor changes its signing secret.
The signing secret is returned by exactly two operations, create and rotate, and by nothing else. Store it when you read it.