Subscribe to every received message

Registers a public HTTPS URL that receives a signed POST for EVERY inbound iMessage / SMS on the account (a draft's responseWebhook only covers that one thread). The response carries data.secret (whsec_…) exactly once — store it. Re-subscribing the same url rotates the secret and re-enables a disabled subscription (200); a new URL is 201. At most 5 per account (409 webhook_limit). Private, loopback and link-local targets are rejected (400), and the target is re-checked at every delivery; redirects are never followed. After 25 consecutive failed deliveries the subscription is switched off (disabled: true) until it is re-subscribed.

Deliveries: POST JSON { event: "message.received", conversationId, messageId, message: { body, from, sentDate, hasAttachments } } with X-AutoMessage-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>" keyed with the secret>. Verify in constant time and reject timestamps older than a few minutes.