Create or replace the project webhook for the project behind the API key, and activate it. The response carries the signing secret; an existing secret is kept.

This is where invitation.status_changed is delivered. Events are scoped to this project: when you onboard clients in sub-accounts, call this with each sub-account's API key.

{
  "url": "https://your-app.com/webhooks/zavu",
  "events": [
    "invitation.status_changed"
  ]
}

{
  "webhook": {
    "url": "https://your-app.com/webhooks/zavu",
    "secret": "whsec_abc123..."
  }
}