The `/api/1.0/notify` route is POST-only; you can constrain that here as well.