POST /v1/campaigns/unsubscribe

Authentication

This endpoint is public. It takes no credential and no organisation — it is what our own marketing site and AI answer engines read.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X POST https://api.zinndigital.com/v1/campaigns/unsubscribe \
  -H "Content-Type: application/json" \
  -d '{ "token": <string> }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

The link in the footer of every marketing message, and the target of the one-click `List-Unsubscribe-Post` header (RFC 8058). ⛔ Deliberately unauthenticated: somebody leaving a marketing list has no reason to sign in first, and a one-click unsubscribe is submitted by the mail client itself with no session at all. The authorization is the SIGNATURE on the token, which names the address it may act on, so it cannot be replayed against anybody else. Nothing is read from the request beyond the token. The token does not expire. A message read a year later must still unsubscribe. Always `200` for a validly-signed token, including one naming an address we have never seen — distinguishing the two would make this an address-enumeration oracle, and the outcome is identical either way.

Request body

Response

Errors this endpoint can return

422