---
title: "Sign this phone up for the app's push notifications"
method: POST
path: "/_run402/push/subscriptions"
tags: ["Stable Hosts"]
---

# Sign this phone up for the app's push notifications

`POST /_run402/push/subscriptions`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/_run402/push/subscriptions`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-Http-r402_session`

tenant-web-push. A signed-in end user only (an end-user Bearer, else the hosted-auth cookie), from a page on the app's own origin. A user holds up to 10 phones; an 11th replaces the one that re-confirmed longest ago. Not served from api.run402.com.

## Request body

- PushSubscriptionRequest
  - `endpoint` string, uri, required: Must be on a browser push service (Google, Apple, Mozilla or Microsoft).
  - `keys` object, required
    - `p256dh` string, required
    - `auth` string, required
  - `expiration_time` integer, nullable

## Response `200`

Already signed up; re-confirmed.

- PushSubscriptionResponse
  - `subscription_id` string, required
  - `user_id` string, uuid, required
  - `status` 'subscribed', required
  - `replaced_subscription_id` string, nullable, required: The user's phone that re-confirmed longest ago, replaced because this was an 11th.

## Other responses

- `201`: New phone.
- `400`: VALIDATION_FAILED: an endpoint that is not a browser push service, or malformed keys.
- `401`: AUTH_REQUIRED: no signed-in user.
- `403`: R402_AUTH_CSRF_ORIGIN_MISMATCH (another origin) or FORBIDDEN (a service key is not an end user).

## Changes

- **2026-10-21** `cc6ccb110365`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/run402/apis/run402-api/changes/_run402/push/subscriptions/post.md)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/cc6ccb110365?raw)