PP-11369: Adds information about webhook callback URL restrictions (#943

)

* Adds information about webhook callback URL restrictions

source/webhooks/index.html.md.erb

@@ -32,6 +32,10 @@ You must set up your endpoint to receive the `POST` body from your webhook and r
 
 Your callback URL must use HTTPS and present a valid certificate. GOV.UK webhooks support TLS version 1.2.
 
+Your callback URL must have a domain that ends with `.gov.uk`. This restriction does not apply if you're using webhooks on a test service.
+
+We can allow other domains if you cannot host your callback URL on a domain that ends with `.gov.uk`. You can ask us to allow a domain by emailing support at [[email protected]](mailto:[email protected]). We'll only allow domains that exclusively belong to your service or your service's parent organisation. There may be a delay before we allow your domain to give us time to discuss your request.
+
 ## Create a webhook
 
 You can create a webhook for your service from the [GOV.UK Pay admin tool](https://selfservice.payments.service.gov.uk/login).