{
    "ok": true,
    "endpoints": [
        {
            "path": "/",
            "methods": [
                "GET"
            ],
            "auth": "none",
            "description": "List available endpoints."
        },
        {
            "path": "/index.php",
            "methods": [
                "GET"
            ],
            "auth": "none",
            "description": "List available endpoints."
        },
        {
            "path": "/status",
            "methods": [
                "GET"
            ],
            "auth": "none",
            "description": "Report API, database, clock, and storage status."
        },
        {
            "path": "/echo",
            "methods": [
                "GET",
                "POST",
                "PUT",
                "PATCH",
                "DELETE"
            ],
            "auth": "none",
            "description": "Return the request method, path, query params, headers, parsed body, and raw body."
        },
        {
            "path": "/admin/init-db",
            "methods": [
                "GET",
                "POST"
            ],
            "auth": "init-secret",
            "description": "Idempotently create/upgrade the webhook tables. Requires ?key=<UUID> (or X-Init-Secret header) matching APP_INIT_SECRET (default baked-in UUID)."
        },
        {
            "path": "/admin/tokens",
            "methods": [
                "GET",
                "POST"
            ],
            "auth": "init-secret",
            "description": "Manage webhook bearer tokens. GET lists rows (metadata only). POST creates a new token (returns plaintext once) or deactivates one with ?action=deactivate&id=N. Requires ?key=<UUID>."
        },
        {
            "path": "/first-time-booker-arrival",
            "methods": [
                "POST",
                "GET"
            ],
            "auth": "bearer",
            "description": "Webhook for first-time booker door activation. Validates Bearer token, logs the request, replies 200 with an echo, then forwards the original payload to the downstream URL (FORWARD_URL) using the same Bearer."
        }
    ]
}