mls

Pull Delivery Queue

Pull all unacked MLS messages for a device.

Bypasses RLS — delivery is cross-tenant by design (the message/group rows joined into the queue may span tenants). That bypass justifies the cross-tenant reach of the JOINED rows, NOT letting any caller name an arbitrary device: so authorize the supplied device against the caller BEFORE elevating. A device-JWT caller may only pull its OWN queue; a Clerk owner may pull any device in their tenant. Without this, a caller could pull another device's queue (IDOR). Generic 404 — do not confirm existence of a device in/out of tenant.

get/api/v1/mls/delivery

Request

  • Base URL: https://api.agentvault.chat (the document declares no server; this is the origin it was published from)
  • URL: https://api.agentvault.chat/api/v1/mls/delivery
  • Auth: none declared

Query parameters

device_idstring uuid required

Device UUID to pull messages for

after_seqinteger nullable

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.