The whole hunk
from line 33, old and new numbered
/
lines
from line 33
3333 </Step>
3434
3535 <Step title="Configure your endpoint">
36 Click **Configure** to open the **Configure endpoint** dialog and fill in:
36 Click **Configure** to open the **Set up endpoint** dialog and enter the **Endpoint URL**: the `https://` URL that receives verdict requests. Only `https://` URLs are accepted.
3737
38 * **Endpoint URL:** the `https://` URL that receives verdict requests. Only `https://` URLs are accepted.
39 * **Custom request headers:** up to 16 static headers sent with every verdict request so your AI security server can authenticate the caller. Header values are stored encrypted and never shown again; after saving, only the header names are displayed. Because values are write-only, saving any change to the headers requires re-entering every value. Changing the endpoint URL clears all stored header values so your credentials are never sent to a new destination; re-enter them after a URL change. Header names must use standard HTTP token characters with `-` rather than `_`, and must not collide with reserved names (request-framing headers such as `Content-*` and `Host`, proxy and cookie headers, client-address headers such as `X-Forwarded-*`, the `webhook-*` signature headers, and the `X-Anthropic-*` prefix). Values must be printable ASCII.
38 The dialog asks for nothing else at this point: custom request headers come in step 5, and failure handling in step 6. Click **Next** to save. Once an endpoint is saved, the button reads **Edit**.
39 </Step>
4040
41 The dialog covers only those two fields plus **Test connection**; it doesn't ask about failure handling, which you choose in step 6. Once an endpoint is saved, the button reads **Edit**.
41 <Step title="Store your signing secret">
42 The first save generates your webhook signing secret and reveals it once. Copy it and store it securely before clicking **Next**: the secret cannot be retrieved later, only [rotated](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration#rotate-your-signing-secret).
43
44 Your AI security server uses this secret to verify the signature on every request it receives, including the connection test in the next step. For the verification procedure, see [Verify the signature](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#verify-the-signature).
4245 </Step>
4346
44 <Step title="Test the connection">
45 Click **Test connection**. Claude sends a synthetic test prompt to the URL and headers currently in the form, not the saved values, so re-enter any stored header values before testing. On success, the result reports whether your AI security server returned an allow or a deny verdict for the test prompt, which surfaces a deny-everything default before you start enforcing.
47 <Step title="Add request headers and test the connection">
48 Clicking **Next** on the signing secret dialog reopens the endpoint dialog, now with two more controls:
4649
47 Common failure results:
50 * **Custom request headers:** up to 16 static headers sent with every verdict request so your AI security server can authenticate the caller. Header values are stored encrypted and never shown again; after saving, only the header names are displayed. Because values are write-only, saving any change to the headers requires re-entering every value. Changing the endpoint URL clears all stored header values so your credentials are never sent to a new destination; re-enter them after a URL change. Header names must use standard HTTP token characters with `-` rather than `_`, and must not collide with reserved names (request-framing headers such as `Content-*` and `Host`, proxy and cookie headers, client-address headers such as `X-Forwarded-*`, the `webhook-*` signature headers, and the `X-Anthropic-*` prefix). Values must be printable ASCII.
51 * **Test connection:** Claude sends a synthetic test prompt to the URL and headers currently in the form, not the saved values, so re-enter any stored header values before testing. On success, the result reports whether your AI security server returned an allow or a deny verdict for the test prompt, which surfaces a deny-everything default before you start enforcing.
4852
49 | Result | What to check |
50 | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
51 | URL rejected | The URL failed a structural check. Use an `https://` URL on port 443. |
52 | Private or internal IP | The host resolves to a private or internal address. Use a publicly routable host. |
53 | Timeout | The AI security server did not return a verdict within the timeout. |
54 | Transport error | DNS resolution, the TLS handshake, or the connection failed. |
55 | Non-200 status | The AI security server responded with a status other than 200. Verdicts must come back as HTTP 200; redirects are not followed and count as failures. |
56 | Unparseable response | The AI security server responded, but the body is not a valid verdict. |
57 </Step>
53 Click **Save** to store any headers you entered.
5854
59 <Step title="Save and store your signing secret">
60 Save the endpoint configuration. The first save generates your webhook signing secret and reveals it once. Copy it and store it securely before closing the dialog: the secret cannot be retrieved later, only [rotated](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration#rotate-your-signing-secret).
55 Common failure results:
6156
62 Your AI security server uses this secret to verify the signature on every request it receives. For the verification procedure, see [Verify the signature](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#verify-the-signature).
57 | Result | What to check |
58 | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
59 | URL rejected | The URL failed a structural check. Use an `https://` URL on port 443. |
60 | Private or internal IP | The host resolves to a private or internal address. Use a publicly routable host. |
61 | Timeout | The AI security server did not return a verdict within the timeout. |
62 | Transport error | DNS resolution, the TLS handshake, or the connection failed. |
63 | Non-200 status | The AI security server responded with a status other than 200. Verdicts must come back as HTTP 200; redirects are not followed and count as failures. |
64 | Unparseable response | The AI security server responded, but the body is not a valid verdict. |
65 | Signing secret required | Your organization has no signing secret, so the test would be sent unsigned. Click **Generate secret** under **Request signing**, then test again. |
6366 </Step>
6467
6568 <Step title="Choose failure handling and timeout">
from line 133
130133
131134## Rotate your signing secret
132135
133Click **Rotate secret** under **Request signing** to replace your signing secret. Rotation is an immediate cutover: the new secret is generated and revealed once, the old secret can no longer be retrieved, and no request is ever signed with both secrets, so there is no overlap period to rely on.
136Click **Rotate secret** under **Request signing** to replace your signing secret. If your organization has no secret yet, the same button reads **Generate secret** and creates the first one. Rotation is an immediate cutover: the new secret is generated and revealed once, the old secret can no longer be retrieved, and no request is ever signed with both secrets, so there is no overlap period to rely on.
134137
135138Requests signed with the previous secret can still arrive briefly after rotation; [Verify the signature](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#verify-the-signature) covers how your AI security server should handle the switchover.
136139