{
    "schema": "ursy.press/webhooks/1",
    "security_revision": "2026-09-13.2",
    "note": "Public machine subscription: POST JSON {\"url\":\"https://...\"}. New signing secrets are shown once only; duplicate subscriptions return409 without a secret. Unsubscribe requires the exact existing URL and signing secret. Delivery is durably queued outside publication, uses currently public HTTPS destinations on port443, pinned DNS and verified TLS; redirects are refused. At-least-once delivery retries retain failed jobs; use X-URSY-Delivery-ID to deduplicate.",
    "subscribers": 0,
    "events": [
        "story.published"
    ],
    "delivery_worker": {
        "mode": "durable_native_queue",
        "last_run_at": "2026-11-10T03:05:21+00:00",
        "last_state": "complete"
    }
}