An inbox for your account.
Follow account access, wallet activity and business connections in Notifications. These endpoints use your authenticated app session; merchant API keys cannot read or change your inbox.
01Read current account updates
Use all/unread and category filters, then follow nextCursor with before for another page. Account events belong only to you. Workspace details require current membership, and the dashboard selects the matching workspace before opening an activity.
02Choose optional email
Payment, integration and team email are optional. Essential account, credential, recipient, permission and public support alerts remain enabled. Support notification text never includes conversation content. In-app notifications remain available independently of email. Preference writes include their original expectedRevision.
03Preserve the original read boundary
Mark all read with the readThrough identifier returned by your original inbox response. Later arrivals remain unread even when their source timestamp is older. An interrupted mutation must reuse its original Idempotency-Key and body.
04Inspect the source before acting
Fixed notification text points to authenticated current records. A notification, email or browser redirect cannot establish that a payment is final or an order can be fulfilled. Check the current order or transaction through its own API.
05Understand email status
Accepted means the SMTP provider accepted the message, not that it reached your inbox. Unknown responses can be retried with the same Message-ID and may result in duplicate email. The in-app record remains deduplicated. Without configured SMTP, inbox processing continues and requested mail stays queued.
06Operate the separate worker
Notification projection and delivery use a separate SQL identity and protected SMTP configuration. Admin Notification delivery exposes aggregate backlog, heartbeat and outcomes with current operator MFA. It does not reveal recipient addresses or raw payloads and cannot modify financial records.
// App-session operations. All POSTs require an Idempotency-Key.
GET /v1/account/notifications?status=unread&category=security&limit=20
// Response contains data, nextCursor, unreadCount and readThrough.
POST /v1/account/notifications/{id}/read
{ "read": true }
POST /v1/account/notifications/read-all
{ "through": "the-original-readThrough-UUID" }
GET /v1/account/notifications/preferences
POST /v1/account/notifications/preferences
{
"expectedRevision": 0,
"securityEmail": true,
"paymentsEmail": true,
"integrationsEmail": false,
"teamEmail": false
}
// Current admin session and authorized operator role/MFA only:
GET /v1/admin/notificationsOpen your workspace