---
title: "Email Unsubscribe"
method: POST
path: "/api/email/unsubscribe"
tags: ["settings", "sync", "ai"]
---

# Email Unsubscribe

`POST /api/email/unsubscribe`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/email/unsubscribe`
- Auth: none declared

A11 unsubscribe receiver. Verifies HMAC token + writes
suppression. Always 200; never reveals whether the user_id
exists (security).

POST (2026-09-08) serves RFC 8058 one-click; `List-Unsubscribe-Post`
is a PROMISE this route accepts it. No `validate_csrf` and no body
read, both deliberate -- a mail provider has no session and the signed
query string IS the authorisation. Why:
docs/board/audit/2026-09-08_CHAOS_list_unsubscribe_headers.md

## Query parameters

- `u` string
- `k` string
- `s` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)