settings
sync
ai
Email Unsubscribe
A11 unsubscribe receiver. Verifies HMAC token + writes suppression. Always 200; never reveals whether the user_id exists (security).
POST (2026-09-08) serves RFC 8058 one-click; List-Unsubscribe-Post is a PROMISE this route accepts it. No validate_csrf and no body read, both deliberate -- a mail provider has no session and the signed query string IS the authorisation. Why: docs/board/audit/2026-09-08_CHAOS_list_unsubscribe_headers.md
post/api/email/unsubscribe
Request
- Base URL: https://www.oxfordledge.com (the document declares no server; this is the origin it was published from)
- URL: https://www.oxfordledge.com/api/email/unsubscribe
- Auth: none declared
Query parameters
ustring
kstring
sstring
Response
Successful Response
unknown required
Changes
No recorded changes to this operation across all 1 revision of this API.