The integrator's URL is a capability you issued

Three partners integrate against your webhook receiver. One of them will leak the URL eventually. You'd rather not rotate everyone's.

Create three aliases on the same container with alias: null. Each comes back as a 48-character hex label, one per partner, all routing to program: http, port: 3000. Give each partner theirs, with an expires_at matching their contract. When the second partner's label turns up in a public gist, DELETE /api/v1/proxy/aliases/{id}. The other two hostnames keep working, and the container's own cryptographic URL never left your hands.

Proxy permissions apply to every hostname alike, so the unguessable name sits on top of auth, not in place of it. Three names, one port, three independent kill switches.

The integrator's URL is a capability you issued, and capabilities are revoked one at a time.