Record an unsubscribe (RFC 8058 one-click or preferences form)
POST /v1/unsubscribe/{token}
Public, unauthenticated. Accepts application/x-www-form-urlencoded and multipart/form-data. A body carrying List-Unsubscribe=One-Click is the RFC 8058 one-click path (single-recipient tokens only); it is idempotent, returns a plain 200 with NO redirects and no cookies. Otherwise it is the preferences-page form: a scope field (narrow selects the “just this sender” opt-out; anything else is org-wide) and, for multi-recipient tokens, an email field validated against the token’s digests before suppressing. Invalid/expired tokens and unverified addresses return a 200 page, never a status-code enumeration oracle.
Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”Opaque, stateless AEAD unsubscribe token placed in the List-Unsubscribe header of an outbound message. Carries tenant/origin context plus either the single recipient (one-click tokens) or truncated per-recipient digests (multi-recipient tokens); no recipient PII is in the URL.
Request Body
Section titled “Request Body ”object
Set to “One-Click” for the RFC 8058 one-click POST.
“narrow” for a just-this-sender opt-out; else org-wide.
Visitor-confirmed address (multi-recipient tokens only).
object
Responses
Section titled “ Responses ”Opt-out recorded (or a graceful invalid/unverified page).
Malformed request body.
Throttled (per-IP/token rate limit).