[moonyue-w]

Change

Add the eight documented Forward webhook endpoint APIs with synchronous/asynchronous resource entrypoints, cursor pagination and typed create/update/list responses. Add original-body HMAC-SHA256 signature verification, multiple v1 signature support and the 300-second timestamp window. Creation returns its signing secret separately from ordinary endpoint responses.

Includes receiver examples, webhook usage documentation, Forward coverage updates and changelog entries. Behavior is aligned with the corresponding Go, Python and TypeScript additions. This is additive and does not change the package version.

Contract source: https://docs.qoder.com/zh/cloud-agents/api/webhooks/overview and https://docs.qoder.com/zh/cloud-agents/api/webhooks/receive.

The usage guide keeps the test endpoint active until the receiver confirms and verifies delivery; temporary endpoint cleanup is a separate step.

Validation

• SDK build, tests and Javadoc pass.
• Independent examples consume the installed JAR and pass.
• Java 8 package and bytecode checks pass.
• Documentation and changelog updated.
• make quality passes on JDK 17.
• No version change required for this feature PR.

After rebasing onto the merged client-extension work in main, reran clean install on Java 8 (603 SDK tests), independent examples/pom.xml clean verify (64 tests), and the package check with an isolated Maven cache. No failures or skips. The original feature was also checked on Java 8/11/17/21/25; GitHub CI validates all five runtimes again on the updated branch.

Before the rebase, live webhook management on Java 8 passed CN/Global × PAT/SA (four Java cases; 16 across the four SDKs). Actual synthetic requests reached Request Catcher; disabled tests queued zero deliveries, active tests queued one, metadata null removed keys, and deletion was verified by a subsequent 404. All temporary endpoints were cleaned up.

A real Global delivery passed all four SDK signature verifiers within the normal timestamp window; tampering was rejected. Live management used the synchronous Java client, while synchronous/asynchronous contracts were both exercised offline. Real business-event subscriptions, receiver persistence/deduplication and server-side failure/retry delivery were not exercised. No credentials, callback URLs, live logs or generated artifacts are committed.