Add / delete / test a webhook (API Pro and above)

act:"add" {url, events?} registers an https URL (max 3 per account) and returns its secret once. act:"delete" {id}. act:"test" {id} delivers a ping right now and returns the HTTP status your server answered. Deliveries: POST JSON {event, ts, hook_id, data} with headers X-MP-Event, X-MP-Delivery, X-MP-Timestamp and X-MP-Signature = sha256=HMAC_SHA256(secret, raw body). Retried 5 times with backoff; paused after 25 consecutive failures.