Confirm an email unsubscribe. Safe to call repeatedly for the same address. On success the decoded email is added to the blacklists suppression table (type=email, event=unsub, source=unsubscribe, plus the token's company_id) so the email dispatcher never sends to it again, and an audit event is logged. A generic the endpoint returns 404 for any invalid/expired token.

Path params

Auth

• Public — no bearer token (unauthenticated campaign group; item marked noauth). Posted from the unsubscribe confirmation page.

Rate limit

• 30 requests/min per IP (public).

Body

• None. The recipient email + company id are carried inside the encrypted {token} path segment.

Behaviour

• 200 { status: "success", message: "You have been unsubscribed." } (same response whether the address was newly added or already present).
• 404 (notFoundResponse) "Invalid or expired unsubscribe link." for any bad/expired token.
• 500 (defaultErrorResponse) on unexpected error.