---
title: "One-click unsubscribe from one ticket's email notifications (RFC 8058)"
method: POST
path: "/v1/tickets/unsubscribe/{token}"
tags: ["public"]
---

# One-click unsubscribe from one ticket's email notifications (RFC 8058)

`POST /v1/tickets/unsubscribe/{token}`

## Request

- Base URL: `https://api.wavehouse.cloud`
- URL: `https://api.wavehouse.cloud/v1/tickets/unsubscribe/{token}`
- Auth: none declared

Public and unauthenticated: the token IS the credential, signed for exactly one (ticket, email) pair and never expiring. Always answers 200 — a mail security scanner prefetching the link must not be able to distinguish a real unsubscribe from a bad token, and there is nothing here worth protecting either way.

## Path parameters

- `token` string, required

## Response `200`

OK

- UnsubscribeTicketOutput
  - `status` string, required: "unsubscribed" or "invalid" (a bad, tampered, or already-removed token)

## Other responses

- `429`: Rate limited, per client IP, API key or org; a client IP is also refused on every route for a while after repeated authentication failures. A limited operation carries RateLimit-Policy and RateLimit on every response; wait Retry-After seconds before retrying.
- `default`: Error

---

[API](https://skmtc.dev/wavehouse/apis/wavehouse-cloud-api.md) · [All operations](https://skmtc.dev/wavehouse/apis/wavehouse-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wavehouse/apis/wavehouse-cloud-api/revisions/adea029bf505?raw)