One-click unsubscribe landing (non-mutating redirect)

GET

/notifications/unsubscribe

const url = 'https://api.tovarifinancial.com/notifications/unsubscribe';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.tovarifinancial.com/notifications/unsubscribe

UNAUTHENTICATED and NON-MUTATING BY CONTRACT. Mail clients, link scanners and corporate security appliances fetch every URL in a message, so a mutating GET would unsubscribe users who never touched the link. This arm performs no database work at all — not even a lookup — and 302s to the SPA confirmation page, which POSTs only from an explicit button. It accepts no idempotency key.

Parameters

Query Parameters

string

The opaque unsubscribe token from the message. Forwarded to the confirmation page; never validated here.

Responses

302

Redirect to the SPA confirmation page. Always 302, for any token value including an absent one — the response is identical either way, so nothing about the token can be inferred from it.

Headers

Location

string

The confirmation page URL, carrying the token as ?t=.

Cache-Control

string

Always no-store.