A valid request URL is required to generate request examples{
"preferences": [
{
"category": "marketing",
"label": "<string>",
"opted_out": true
}
]
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}My notification preferences
The whole catalogue of categories, each with whether this person switched it off — not only the ones they have touched. The absence of a stored decision is consent, so a screen rendering only what is stored would show an empty settings page to everybody who never opened it.
Transactional mail is not listed, because there is nothing here that could stop it.
Unlike the rest of the contact’s self-administration surface this needs no verified session, and the asymmetry is deliberate: the worst an unproven session can do here is switch a category off for the contact it named, which is exactly what the token in that contact’s own inbox already does with no session at all. Demanding more proof for the in-app control than for the emailed one would be the wrong way round.
A valid request URL is required to generate request examples{
"preferences": [
{
"category": "marketing",
"label": "<string>",
"opted_out": true
}
]
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}