Send a webhook for every change a person makes to a record

Events are {resource}.created, .updated, .deleted and .restored for content,
the inbox, redirects, repositories and media, taken from the audit log so the
two agree on what happened. Subscriptions take wildcards. Users, tokens,
webhooks and settings are never sent, nor what the application does by
itself; the inbox's own words only with personal data enabled.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

public/openapi.yaml

@@ -3945,9 +3945,26 @@ paths:
         times over about two and a half hours; twenty failures in a row switch the
         webhook off.
         
-        Events: `application.received` (its sender's details only with
-        `include_personal_data`), `content.published`, `content.unpublished`,
-        `review.requested`, `review.returned` — or `*`.
+        Events with a meaning of their own: `application.received` (its
+        sender's details only with `include_personal_data`),
+        `content.published`, `content.unpublished`, `review.requested`,
+        `review.returned`.
+
+        And every change a person makes to a record, as `{resource}.{action}`
+        — `projects.created`, `pages.updated`, `media.deleted`,
+        `calls.restored` — for pages, categories, tags, projects, members,
+        services, clients, testimonials, talks, technologies, calls,
+        redirects, repositories, media and applications. Its `data` says
+        what (`type`, `id`, `title`, `url` when it is on the site), who
+        (`by`), how they came in (`via`: panel, api, token) and, on an
+        update, `changes` as field → `{old, new}`. What the application does
+        by itself — a sync, a scheduled publication — is not sent. Changes to
+        an application carry only how it is handled unless
+        `include_personal_data`. Users, tokens, webhooks and settings are
+        never sent.
+
+        Subscribe to an event, to `*`, to all of one kind of record
+        (`projects.*`) or to one action on any (`*.deleted`).
       requestBody:
         required: true
         content:
@@ -6200,7 +6217,10 @@ components:
         url: { type: string, format: uri, description: "HTTPS, to a public address." }
         events:
           type: array
-          items: { type: string, enum: ["*", application.received, content.published, content.unpublished, review.requested, review.returned] }
+          items:
+            type: string
+            description: "An event, `*`, `{resource}.*` or `*.{action}`."
+            example: projects.*
         secret: { type: string, minLength: 16, description: On creation only; generated when left out. }
         rotate_secret: { type: boolean, description: On update only. }
         include_personal_data: { type: boolean, default: false }