Authentication
EveryPOST endpoint requires a shared secret in the X-Webhook-Secret header. The scraper compares it in constant time against its WEBHOOK_SECRET environment variable. A missing or wrong value returns 401.
/health needs no secret and reveals only which variable names are missing.
Response conventions
/scrape and /rebuild-index report their own failures in the response body with HTTP 200, so n8n can branch on the result without treating it as a transport error.
/append-index uses HTTP status codes for the one condition the workflow acts on: