---
title: "Settings Email Unsubscribe"
method: GET
path: "/api/settings/email/unsubscribe"
tags: ["settings", "sync", "ai"]
---

# Settings Email Unsubscribe

`GET /api/settings/email/unsubscribe`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/settings/email/unsubscribe`
- Auth: none declared

DEPRECATED 2026-05-28 (H-12 SECURITY_AUDIT P1) — legacy
one-click unsubscribe with no signed token. Allowed anyone who
knew a user's email address to silently disable that user's
critical notifications (payment-failure, security alerts).

Replacement: /api/email/unsubscribe (HMAC-signed token from
email footer link generator). All NEW emails must point at the
signed endpoint.

This handler intentionally NO-OPS — it does NOT call
unsubscribe_by_email anymore. Inbox links sent before the
deprecation are left in a soft-fail state (user sees an
explanatory page + a path to Settings) rather than 410 Gone,
which would surprise users who clicked an old footer link.
Sentry/log capture below tracks volume so we can decide when
to flip to 410 Gone (recommend: after 30 days of <1 hit/day).

## Query parameters

- `email` string

## Response `200`

Successful Response

- SettingsActionResponse: Shared loose response_model for settings/AI-keys/sync/preferences routes. These routes have varied response shapes (per-action) + are user-private (not part of the public typed-client API). Declared for OpenAPI doc coverage.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)