feat: Adding remaining API v2 endpoints - saved searches & webhooks

.changeset/external-api-v2-alerts-response-shapes.md

@@ -0,0 +1,15 @@
+---
+'@hyperdx/api': minor
+---
+
+External API v2: make error responses consistent and add concurrency safety.
+
+- `/api/v2/alerts` `403`/`404` responses now return a JSON `{ message }` body
+  (previously an empty plaintext body), matching the documented `Error` schema
+  and the saved-search/webhook routers.
+- `DELETE /api/v2/alerts/:id` now returns `404` for an alert that does not exist
+  (previously always `200`). The `404` was already part of the documented
+  contract; delete is no longer idempotent for a missing alert.
+- `PUT /api/v2/webhooks/:id` can now return `409` when the webhook's destination
+  (`url`/`service`) was changed concurrently between read and write. Clients
+  should re-read and retry.

.changeset/external-api-v2-list-pagination.md

@@ -0,0 +1,13 @@
+---
+"@hyperdx/api": minor
+---
+
+External API v2: add offset/limit pagination to the alerts, saved-searches, and
+webhooks list endpoints. Each now accepts `limit` (1–1000, default 1000) and
+`offset` (>=0, default 0) query params and returns a `meta: { total, limit,
+offset }` block alongside `data`. Results are sorted by `_id` so paging is
+stable across requests.
+
+Backward compatible: the default `limit` is the maximum (1000), so callers that
+don't paginate keep receiving all their records (up to the cap) as before. Use
+`limit`/`offset` to page through larger result sets.

.changeset/external-api-v2-saved-searches-webhooks-crud.md

@@ -0,0 +1,11 @@
+---
+"@hyperdx/api": minor
+---
+
+External API v2: add bearer-auth CRUD for saved searches and webhooks so
+providers can manage them as resources. Adds a new
+`/api/v2/saved-searches` router (list/get/create/update/delete, team-scoped,
+validates `sourceId` ownership) and upgrades `/api/v2/webhooks` from
+list-only to full CRUD (POST/PUT/DELETE). Webhook `headers` and `queryParams`
+are write-only — accepted on create/update but never returned on read — so
+auth tokens and other secrets do not leak.