Webhooks API

Public POST /open-bot/hooks/:id with HMAC verification.

POST /open-bot/hooks/:hexId

• 401 on bad signature (no reason detail)
• 429 on burst rejects or queue overflow
• 200 ignored/duplicate; 202 accepted with run id
• Secrets encrypted at rest; returned only at create/rotate