Create one signed webhook and download its private signing key.

Private, no-store and no CORS grant. Requires the configured optional webhook service. Only the human account owner can manage destinations. Installation tokens and API keys are refused. Requires recent authentication and CSRF. Generate and retain one random request ID. Retry an uncertain request only with the same ID and exact URL; this returns the same key without another test or registration. One active destination per project, valid for 30 days. Creation queues a separate signed test. Changed inventory, activity that needs attention and changed incomplete coverage use the same committed event as the cursor. The initial reference and routine approved actions do not notify. Delivery uses Standard Webhooks headers webhook-id, webhook-timestamp and webhook-signature. Verify the signature and timestamp before use, then deduplicate webhook-id before any effect. Lost receipts can repeat a delivery. At most six attempts share the global 512 daily attempts with email. Public HTTPS only; no private network or redirect. Recover missing events through the cursor. Returns: { esquema, projeto, webhook, segredo, expira_em }