The endpoint's uuid from /endpoints.

Exact (/health), or a folder and everything under it: /webhooks/* covers /webhooks too, and /webhooks/** is the same. Up to 256 characters, starting with /, decoded (é, not %C3%A9), without a query or a fragment, a \ or ;, an empty segment, a . or .. segment, or a segment ending in a dot or a space. /* and /** are refused (to open every path, turn sign-in off), and so are the sign-in pages under /_tunnel_auth, which are always open. In the protect mode an exact path is saved without a trailing /: it protects both.

Any of GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS (any case), or ["*"] alone for every method. Left out: ["GET", "HEAD"] in the open mode, ["*"] in the protect mode. In the open mode, a path without a signature check that lists POST needs ["*"]: an app can take the method from the body (_method), so such a POST can act as any method.

open (default) or protect, for the first path only. Later paths take the list's mode: leave it out, or send the list's own mode. To change it, use PUT .../access-paths/mode.

open mode only: check the webhook's signature before the request goes through, as the Verify Webhook rule does. A request without a valid signature gets 401, a body over 2 MB gets 413, and neither reaches your app. Needs Verify Webhook in your plan.
• provider (required): github, slack, stripe or generic.
• secret (required): the signing secret from the sender's webhook settings, up to 256 characters. It is stored encrypted and never shown again: answers carry "****".
• generic only, a hex HMAC of the raw body: signature_header (the header that carries it; left out, X-Hub-Signature-256), algorithm (sha256, the default, or sha1) and signature_prefix (taken off the header's value before the check; left out, sha256= or sha1=). The other providers sign their own way and refuse these fields.

A field the API doesn't know (invalid json payload), or a field it refuses, named in fields: the path, the methods, the mode or the signature check, with what to send instead. In the open mode, POST without a signature check and without every method: Without a signature check, a POST on this path can act as any method, so opening POST opens every method: send ["*"], or add a signature check.

Missing auth.

Your role lacks endpoints:update, or a signature check without Verify Webhook in your plan ("code": "entitlement_required", "entitlement_required": "traffic_rule:verify-webhook").

No such endpoint in your active account.

this path is listed already: change its methods instead; the endpoint lists max_paths paths already; a mode other than the list's (switch the mode first, or leave mode out); a signature check on a protect list; the older protected_paths setting is still on (send "protected_paths": [] with the sign-in settings first); or the endpoint is paused over your plan's quota ("code": "quota_paused").