Create a push-subscription

POST

/push-subscriptions

• Current canonical versioned path (F3.API.01)

Authorizations

• bearerAuth
• apiTokenAuth

Request Body ^required

object

data

object

endpoint

required

Push service endpoint URL (unique per browser subscription, not a secret, but treated as sensitive since it identifies the device).

string

p256dh_key

DEPRECATED plaintext field — retained read-only for pre-encryption legacy rows. New writes always go to encrypted_p256dh_key. NEVER returned by the API.

string

auth_key

DEPRECATED plaintext field — retained read-only for pre-encryption legacy rows. New writes always go to encrypted_auth_key. NEVER returned by the API.

string

encrypted_p256dh_key

AES-256-GCM encrypted PushSubscription.keys.p256dh (F3.PWA.01) — same iv:authTag:ciphertext:salt format as BYOC cloud-credential (src/utils/credential-crypto.ts). NEVER returned by the API; decrypted only server-side by push-notifier for dispatch.

string

encrypted_auth_key

AES-256-GCM encrypted PushSubscription.keys.auth (F3.PWA.01). NEVER returned by the API.

string

event_filters

Array of subscribed event-type strings. Canonical catalog (F3.CHATOPS.01/F3.PWA.01): ‘billing.payment_failed’, ‘billing.trial_ending’, ‘cloud-instance.provision_failed’, ‘alert.fired’. Empty/null = all events.

enabled

boolean

user_agent

Browser User-Agent at subscribe time — helps the user identify which device/browser a subscription belongs to in settings.

string

last_sent_at

string format: date-time

failure_count

integer

user

One of:

string

DocumentId reference to plugin::users-permissions.user

string

object

object

key

additional properties

any

organisation

One of:

string

DocumentId reference to api::organisation.organisation

string

object

object

key

additional properties

any

Responses

200

Created

object

data

object

endpoint

required

Push service endpoint URL (unique per browser subscription, not a secret, but treated as sensitive since it identifies the device).

string

p256dh_key

DEPRECATED plaintext field — retained read-only for pre-encryption legacy rows. New writes always go to encrypted_p256dh_key. NEVER returned by the API.

string

auth_key

DEPRECATED plaintext field — retained read-only for pre-encryption legacy rows. New writes always go to encrypted_auth_key. NEVER returned by the API.

string

encrypted_p256dh_key

AES-256-GCM encrypted PushSubscription.keys.p256dh (F3.PWA.01) — same iv:authTag:ciphertext:salt format as BYOC cloud-credential (src/utils/credential-crypto.ts). NEVER returned by the API; decrypted only server-side by push-notifier for dispatch.

string

encrypted_auth_key

AES-256-GCM encrypted PushSubscription.keys.auth (F3.PWA.01). NEVER returned by the API.

string

event_filters

Array of subscribed event-type strings. Canonical catalog (F3.CHATOPS.01/F3.PWA.01): ‘billing.payment_failed’, ‘billing.trial_ending’, ‘cloud-instance.provision_failed’, ‘alert.fired’. Empty/null = all events.

enabled

boolean

user_agent

Browser User-Agent at subscribe time — helps the user identify which device/browser a subscription belongs to in settings.

string

last_sent_at

string format: date-time

failure_count

integer

user

One of:

string

DocumentId reference to plugin::users-permissions.user

string

object

object

key

additional properties

any

organisation

One of:

string

DocumentId reference to api::organisation.organisation

string

object

object

key

additional properties

any

documentId

string

id

integer

createdAt

string format: date-time

updatedAt

string format: date-time

publishedAt

string format: date-time

nullable

400

Validation error

401

Missing or invalid authentication

403

Not authorized (tenant scope or capability)