MailerHandleUnsubscribe¶

POST mailer/unsubscribe

The public endpoint behind the unsubscribe link and the List-Unsubscribe-Post header. It is not called by integrations: the token comes from the email itself.

The token is signed with HMAC and carries the address, the brand and an expiry, so nobody can unsubscribe someone else by editing a URL — and no session is needed, because a recipient clicking a link in an email has none.

Access Control¶

Public. The request is authenticated by the signed token, which is verified in constant time and checked for expiry.

Request¶

RESTTCPSDK

POST https://{broker_domain}/mailer/unsubscribe

{
  "token": "eyJlIjoiY2xpZW50QGV4YW1wbGUuY29tIiwiYiI6ImRlZmF1bHQi…"
}

{
  "command": "MailerHandleUnsubscribe",
  "extID": "1",
  "data": {
    "token": "eyJlIjoiY2xpZW50QGV4YW1wbGUuY29tIiwiYiI6ImRlZmF1bHQi…"
  }
}

const res = await platform.MailerHandleUnsubscribe({
  token: "eyJlIjoiY2xpZW50QGV4YW1wbGUuY29tIiwiYiI6ImRlZmF1bHQi…"
});

Request Data¶

Field	Type	Required	Description
`token`	string	Yes	Signed token from the unsubscribe link

Behavior¶

One click is enough: Gmail and Outlook send a POST to the List-Unsubscribe-Post URL without opening a page, and an unsubscribe that requires a login or a confirmation form counts as a failed unsubscribe against the sender.
The recipient is suppressed with reason UNSUBSCRIBE and source RECIPIENT, so it blocks marketing but not confirmation codes.
The module emits mailer.recipient.unsubscribed, so the CRM customer card shows the opt-out rather than only the mailer table.

Response Data¶

created: false means the address was already on the list — the answer is still success, because from the recipient point of view they are unsubscribed either way.

{
  "email": "[email protected]",
  "created": true,
  "unsubscribed": true
}

Errors¶

Code	Error	Description
`400`	`INVALID_UNSUBSCRIBE_TOKEN`	Token is malformed, has a bad signature, or has expired