Creates a new webhook endpoint for the company and subscribes it to the specified event types, so matching events are delivered to the given URL as they occur.

Each company is limited to 10 webhook endpoints — exceeding this quota returns a 429. The secret field in the response (used to verify payload signatures) is returned only on this create call and cannot be retrieved again afterward, so store it securely.