> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serializedaudit.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Set the delivery endpoint (push webhook)

> Register the HTTPS URL that audit-change events are POSTed to, and get an HMAC signing secret (returned ONCE). Updating the URL keeps the existing secret; pass `rotate: true` to force a new one. Subscribing does NOT require a webhook; it only controls push delivery. See SSE & Webhooks.



## OpenAPI

````yaml /api-reference/openapi.json put /webhook
openapi: 3.1.0
info:
  title: Serialized Audit API
  version: 1.0.0
  description: Submit a contract address and chain, receive an instant risk verdict.
servers:
  - url: https://www.serializedaudit.io/api
security:
  - apiKey: []
paths:
  /webhook:
    put:
      summary: Set the delivery endpoint (push webhook)
      description: >-
        Register the HTTPS URL that audit-change events are POSTed to, and get
        an HMAC signing secret (returned ONCE). Updating the URL keeps the
        existing secret; pass `rotate: true` to force a new one. Subscribing
        does NOT require a webhook; it only controls push delivery. See SSE &
        Webhooks.
      operationId: setWebhook
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - url
              properties:
                url:
                  type: string
                  format: uri
                  description: HTTPS delivery URL.
                rotate:
                  type: boolean
                  description: Force a new signing secret.
                secret:
                  type: string
                  description: >-
                    Supply your own secret (16-256 chars) instead of a generated
                    one; never echoed back.
      responses:
        '200':
          description: Webhook configured.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookConfigResult'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    WebhookConfigResult:
      type: object
      required:
        - ok
        - url
      properties:
        ok:
          type: boolean
        url:
          type: string
          format: uri
        secret:
          type: string
          description: >-
            HMAC signing secret (whsec_...). Returned ONLY on a fresh config or
            a rotate, so store it; it is never shown again.
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          description: Human-readable error message.
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-Auth-Key
      description: Your secret API key. Create one from your dashboard.

````