OKTA-1238449 - Event hook type limitation (#6350)

* Initial draft of event type limit per hook

* Minor upddates after local review

* Remove line in Rate Limits as per review

Author: brianduffield-okta

packages/@okta/vuepress-site/docs/concepts/event-hooks/index.md

@@ -17,7 +17,7 @@ Okta event hooks are an implementation of the industry concept of webhooks. Okta
 
 Before the introduction of event hooks, polling the [System Log API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SystemLog/) was the only method your external software systems could use to detect the occurrence of specific events in your Okta org. Event hooks provide an Okta-initiated push notification.
 
-You can have a maximum of 25 active and verified event hooks set up in your org at any time. Each event hook can be configured to deliver multiple event types.
+You can have a maximum of 25 active and verified event hooks set up in your org at any time. Each event hook can be configured to deliver multiple event types (with a limit of 300 eligible event types per hook).
 
 > **Note:** To deliver event information, event hooks use the data structure associated with the [System Log API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SystemLog/).
 
@@ -289,5 +289,5 @@ The following is an example of a JSON payload of a request from Okta to your ext
 
 ## See also
 
-- [Event hooks management APIs](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/EventHook/#tag/EventHook)
-- [Hooks best practices](/docs/guides/hooks-best-practices/)
+* [Event hooks management APIs](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/EventHook/#tag/EventHook)
+* [Hooks best practices](/docs/guides/hooks-best-practices/)

packages/@okta/vuepress-site/docs/guides/hooks-best-practices/index.md

@@ -32,7 +32,7 @@ To prevent a malicious actor from making requests to the endpoint where your Okt
 
 * Configure Okta to send an authentication header in the hook and validate it in every request by one of two ways:
 
-  * Using [HTTP Basic Authentication](/books/api-security/authn/api-authentication-options/#http-basic-authentication). When activating and enabling hooks in an org, set the **Authorization field** to `Authorization`, and ensure that the **Authentication secret** is in the Base64-encoded `user:password` format.
+  * Using [HTTP Basic Authentication](/docs/guides/secure-hooks/nodejs/main/#http-header-basic-authentication). When activating and enabling hooks in an org, set the **Authorization field** to `Authorization`, and ensure that the **Authentication secret** is in the Base64-encoded `user:password` format.
 
     >**Note:** You must include the authentication scheme as part of the **Authentication secret**. For Basic Authentication, your secret must appear similar to: `Basic Base64(user:password)`. See the following partial hook header as an example:
 
@@ -83,7 +83,8 @@ Your external service that processes hook requests must consider that the order
 | Hook type | Limit type | Limit | Description |
 | --------- | -----------| ----- | ----------- |
 | Event hook | Number of daily events | 400,000 | A maximum of 400,000 applicable events that trigger event hooks, per org, per day. Event hooks aren't recorded or replayed after this point. If a request times out after three seconds, event hooks are retried once. Retries don't count toward the org limit.
-|            | Maximum number of event hooks per org | 25 | A maximum of 25 active event hooks can be configured per org. You can configure each event hook to deliver multiple event types. |
+|            | Maximum number of event hooks per org | 25 | A maximum of 25 active event hooks can be configured per org.  |
+|            | Maximum number of event types per hook | 300 | A maximum of 300 eligible event types can be configured per event hook. |
 | Inline hook | Timeout | 3 seconds | Inline hooks have a completion timeout of three seconds with a single retry. However, a request isn't retried if your endpoint returns a 4xx HTTP error code. Any 2xx code is considered successful, and the request isn’t retried. If the external service endpoint responds with a redirect, it isn't followed. |
 |             | Maximum number of inline hooks per org | 100 | The maximum number of inline hooks that you can configure per org is 100, which is a total for any combination of inline hook types. |
 |             | Concurrent rate limit | Variable | The maximum number of inline hooks that can be sent concurrently based on org type. See [Concurrent rate limits](/docs/reference/rl2-concurrency/).|