> ## Documentation Index
> Fetch the complete documentation index at: https://www.openpmm.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage webhooks

> Manage webhook endpoints, signed post events, and delivery tests with the OpenPMM CLI.

## Manage endpoints

```bash theme={null}
openpmm webhooks list --workspace ws_01JABCDEF --json

openpmm webhooks create \
  --workspace ws_01JABCDEF \
  --name production \
  --url https://example.com/openpmm/events \
  --events post.published,post.failed \
  --json

openpmm webhooks show wh_... --workspace ws_01JABCDEF --json
openpmm webhooks update wh_... --workspace ws_01JABCDEF --enabled false
openpmm webhooks test wh_... --workspace ws_01JABCDEF --json
openpmm webhooks delete wh_... --workspace ws_01JABCDEF --yes
```

`webhooks create` returns its signing secret one time. It rejects `--quiet`
and `--jsonl` because those modes could discard the secret.

Rotate a signing secret when it may be exposed:

```bash theme={null}
openpmm webhooks rotate-secret wh_... \
  --workspace ws_01JABCDEF \
  --json
```

Store the returned secret immediately. The command returns it one time.

## Verify a payload locally

Save the exact request body bytes. Do not parse and serialize the payload
before verification.

```bash theme={null}
OPENPMM_WEBHOOK_SECRET=whsec_... openpmm webhooks verify \
  --signature 't=...,v1=...' \
  --file ./payload.json
```

`webhooks verify` runs locally and does not require an API key. It rejects a
signature outside a five-minute tolerance by default. Use `--secret-file`
when you keep the signing secret in a protected file.