Treating timed_out as a normal response, with a 55 second cap, fits scripts and CI jobs that can't receive a webhook. Returning the message id next to the code is handy too, since the caller can open the full message if the parsed code looks wrong. Is the after timestamp the intended way to make sure an older code already sitting in the inbox isn't returned?