{
  "service": "otp-webhook",
  "endpoints": {
    "POST /otp": "ingest (header X-Webhook-Secret)",
    "GET /otps?token=\u2026": "full feed (&limit=N, &q=substring)",
    "GET /otps/latest?token=\u2026": "most recent OTP",
    "GET /view?token=\u2026": "browsable HTML viewer",
    "GET /health": "status, no auth"
  }
}