{
    "service": "Hostmaster Security API",
    "auth": "Bearer token required on all endpoints except this one",
    "endpoints": {
        "POST /scan": "Trigger mailbox scan. Body: {\"what\": \"password-reset\"}",
        "GET /blocked-ips": "List recommended IPs to block (>3 hits)",
        "GET /countries": "List country threat rules",
        "GET /status": "Last scan info and stats"
    }
}