Wrapped POSTs JSON payloads to Url. If RequestHeaderVerificationToken is set, each delivery carries an
HMAC-Signature-SHA256 header — the Base64 HMAC-SHA256 of the raw body, keyed with your secret — so you can
verify the request came from Wrapped. The secret itself is never sent.

Each delivery is attempted once; failures are not retried. Return any 2xx quickly. A webhook that has failed six
times over its lifetime is disabled and stops appearing in List; register it again once your endpoint is well.