---
title: "RFC 8058 one-click unsubscribe"
method: POST
path: "/public/email-preferences/unsubscribe"
tags: ["Public"]
---

# RFC 8058 one-click unsubscribe

`POST /public/email-preferences/unsubscribe`

## Request

- Base URL: `https://api.atako.ai`
- URL: `https://api.atako.ai/public/email-preferences/unsubscribe`
- Auth: none required

What Gmail's and Outlook's own unsubscribe buttons call, from the `List-Unsubscribe` header the optional emails carry. Same token and same effect as the GET. The token is an HMAC over `userId:family` minted into the email itself — no session, nothing to enumerate, and no expiry, because an unsubscribe link in a two-year-old email must still work. Applies to the three OPTIONAL families only; essential email (sign-in codes, receipts, security alerts, terms updates) has no opt-out. Every write merges, so unsubscribing from one family never resubscribes another.

## Query parameters

- `token` string

## Response `200`

- object
  - `ok` boolean, required

## Other responses

- `400`: Invalid or tampered token.
- `429`: too_many_requests

---

[API](https://skmtc.dev/atako/apis/atako-api.md) · [All operations](https://skmtc.dev/atako/apis/atako-api/llms.txt) · [OpenAPI document](https://skmtc.dev/atako/apis/atako-api/revisions/aa555c56fbd7?raw)