Skip to content
Tovari Docs

Turn bulk notification email off (RFC 8058 one-click)

POST
/notifications/unsubscribe
curl --request POST \
  --url https://api.tovarifinancial.com/notifications/unsubscribe

UNAUTHENTICATED, and EVERY OUTCOME IS THE SAME 200 with the same body: a valid token, an invalid one, an expired one, an absent one and an internal failure are indistinguishable. With no authentication, any difference between those cases would be an oracle an attacker could enumerate, so there is no error code and no details here by design. The token is read from the ?t= QUERY STRING on both body forms, which is what lets one code path serve a mail client’s List-Unsubscribe=One-Click form POST and the confirmation page’s JSON POST. It accepts NO X-Idempotency-Key — the idempotency store is org-scoped and this path has no org context — and needs none: the effect is convergent. Unsubscribing turns BULK mail off; transactional security and data-export notices, which carry no List-Unsubscribe header, keep sending, and the in-app feed is never affected.

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
t
string

The opaque unsubscribe token from the message.

Responses

Section titled “Responses”

200

Section titled “200”

Acknowledged — byte-identical for every outcome

Media typeapplication/json
object
data
required
object
ok
required
boolean
message
string
requestId
required
string
timestamp
required
string format: date-time
Examplegenerated
{
  "data": {
    "ok": true
  },
  "message": "example",
  "requestId": "example",
  "timestamp": "2026-04-15T12:00:00Z"
}