Performed once per subscription, at creation, before any delivery — regardless of how many event types the subscription covers, so this operation is documented once here rather than repeated under every event. Subscriber must respond 2xx with WebHook-Allowed-Origin matching the sender's origin (or '*') to be marked Valid and receive deliveries.