Settings Email Unsubscribe
DEPRECATED 2026-05-28 (H-12 SECURITY_AUDIT P1) — legacy one-click unsubscribe with no signed token. Allowed anyone who knew a user's email address to silently disable that user's critical notifications (payment-failure, security alerts).
Replacement: /api/email/unsubscribe (HMAC-signed token from email footer link generator). All NEW emails must point at the signed endpoint.
This handler intentionally NO-OPS — it does NOT call unsubscribe_by_email anymore. Inbox links sent before the deprecation are left in a soft-fail state (user sees an explanatory page + a path to Settings) rather than 410 Gone, which would surprise users who clicked an old footer link. Sentry/log capture below tracks volume so we can decide when to flip to 410 Gone (recommend: after 30 days of <1 hit/day).
Request
- Base URL: https://www.oxfordledge.com (the document declares no server; this is the origin it was published from)
- URL: https://www.oxfordledge.com/api/settings/email/unsubscribe
- Auth: none declared
Query parameters
Response
Successful Response
Shared loose response_model for settings/AI-keys/sync/preferences routes. These routes have varied response shapes (per-action) + are user-private (not part of the public typed-client API). Declared for OpenAPI doc coverage.
Changes
No recorded changes to this operation across all 1 revision of this API.