Add webhook management to the public API, SDK, and support Machine Identity auth on webhook endpoints

[aboutrax]

Summary

The webhook management endpoints (/api/v1/webhooks) are fully implemented in the
backend but are currently inaccessible to automation tooling due to two gaps:

1. All webhook routes only accept AuthMode.JWT (user session) — Machine Identity
   tokens are not supported
2. The endpoints are not documented in the public API reference
3. The Node SDK has no webhook management methods

---

Current behavior

From webhook-router.ts, every route is gated with:

onRequest: verifyAuth([AuthMode.JWT])

This means the following endpoints exist but cannot be called with a Machine Identity
access token:

Method	Endpoint	operationId
POST	/api/v1/webhooks	createWebhook
GET	/api/v1/webhooks?projectId=	listWebhooks
PATCH	/api/v1/webhooks/:webhookId	updateWebhook
DELETE	/api/v1/webhooks/:webhookId	deleteWebhook
POST	/api/v1/webhooks/:webhookId/test	testWebhook

---

Requested changes

1. Allow Machine Identity auth on webhook endpoints

Update each webhook route to accept AuthMode.IDENTITY_ACCESS_TOKEN alongside JWT:

onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN])

2. Document the endpoints in the public API reference

The operationId fields are already defined, so these endpoints are presumably
ready to be exposed. They should appear under a Webhooks section in the API
reference, consistent with how Secrets, Folders, and Environments are documented.

3. Add webhook management to the Node SDK

The SDK currently only covers secret fetching. Adding webhook management would
allow tools to register and clean up their own webhooks programmatically without
requiring a user session.

Proposed SDK surface:

await client.webhooks.create({
  projectId: string,
  environment: string,
  webhookUrl: string,
  secretPath?: string,
  webhookSecretKey?: string,
  eventsFilter?: { eventName: string }[],
  type?: "general" | "slack"
});

await client.webhooks.list({
  projectId: string,
  environment?: string,
  secretPath?: string
});

await client.webhooks.update(webhookId: string, {
  isDisabled?: boolean,
  eventsFilter?: { eventName: string }[]
});

await client.webhooks.delete(webhookId: string);

await client.webhooks.test(webhookId: string);

---

Motivation

I built Infibridge, a self-hosted webhook
bridge that syncs Infisical secrets to Convex and Dokploy in real time. Currently,
users must manually register the Infisical webhook in the UI after creating a service
bridge. With Machine Identity auth and SDK support, Infibridge (and similar tools)
could register, verify, and clean up webhooks automatically as part of the service
lifecycle — using the same Machine Identity credentials already configured for secret
fetching.

---

Willingness to contribute

Happy to submit a PR for the auth change and SDK methods if the Infisical team is
open to it.