diff --git a/README.md b/README.md
index e736235..76279dc 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,26 @@
 - Flyway for DB schema control
 - JWT for auth
 
+## API Endpoints
+
+### Authentication
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| `POST` | `/auth/register` | Register a new user |
+| `POST` | `/auth/login` | Authenticate and receive a JWT |
+
+### Notes
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| `POST`   | `/notes`           | Create a new note |
+| `GET`    | `/notes`           | List owned notes and notes shared with you |
+| `GET`    | `/notes/{id}`      | Get a note by ID (owner or shared recipient) |
+| `PUT`    | `/notes/{id}`      | Update a note (owner only) |
+| `DELETE` | `/notes/{id}`      | Delete a note (owner only) |
+| `POST`   | `/notes/{id}/share` | Share a note with another user (read-only) |
+
 ## HTTP return codes
 
 Application-defined HTTP status codes are generated in `AuthController` for successful registration and in `GlobalExceptionHandler` for API error responses. Spring Security and Spring MVC may still produce framework-level responses for requests that do not reach a controller, such as unauthenticated protected requests or unsupported methods.