---
title: "Get Site Summary Unsubscribe"
method: GET
path: "/site-summaries/unsubscribe"
tags: ["site summaries"]
---

# Get Site Summary Unsubscribe

`GET /site-summaries/unsubscribe`

## Request

- Base URL: `https://api.verdun.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.verdun.ai/site-summaries/unsubscribe`
- Auth: none declared

Show the confirm form. CHANGES NOTHING, AND VALIDATES NOTHING (R6.7).

Brief §5 had the GET flip the flag; it must not. Mail scanners and link
prefetchers follow GET links, so that shape unsubscribes people who never
clicked — the customer then reports "you stopped sending my report" and
nothing in the system disagrees with them. The state change is the POST.

THE PAGE IS BYTE-IDENTICAL FOR EVERY INPUT, apart from the token echoed
into the hidden field it arrived in. The previous shape rendered a "this
link is no longer valid" page without a form for a bad token and a confirm
page with one for a good token, which is an oracle: anyone holding a
harvested link learns from a single unauthenticated GET whether it is still
live — i.e. whether that contact is still on this site's summary. Nothing
is lost by dropping the distinction, because a forged token then gets a
button whose POST already answers uniformly.

The only branch left is provisioning: with no usable secret the route 503s,
exactly as the POST does, because no link we ever minted can be honoured.

## Query parameters

- `token` string: Unsubscribe token from the e-mail link.

## Response `200`

Successful Response

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/verdun/apis/verdun-api.md) - [All operations](https://skmtc.dev/verdun/apis/verdun-api/llms.txt) - [OpenAPI document](https://skmtc.dev/verdun/apis/verdun-api/revisions/35a2a6ebedda?raw)