Notifications Endpoints — Inbox, Preferences, Push

Granit.Notifications.Endpoints maps all endpoints under the /notifications prefix (configurable via NotificationEndpointsOptions.RoutePrefix). All endpoints require authentication and a permission from NotificationPermissions.

| Permission | Scope | |------------|-------| | Notifications.UserNotifications.Read | Read-only access (inbox, counts, preferences, subscriptions, followers) | | Notifications.UserNotifications.Manage | Write access (mark read, update preferences, subscribe, follow, push tokens) |

IDOR protection

MarkAsReadAsync and RemoveAsync (push tokens) enforce ownership at the store level — the recipientUserId / userId is extracted from the ClaimsPrincipal and passed down to the query filter. A user cannot mark another user’s notification as read or remove another user’s device token.

Inbox

| Method | Route | Permission | Description | |--------|-------|------------|-------------| | GET | /notifications | Read | User’s notification inbox (paged, newest first) | | GET | /notifications/unread/count | Read | Unread notification count | | POST | /notifications/{id}/read | Manage | Mark a single notification as read | | POST | /notifications/read-all | Manage | Mark all notifications as read |

Activity feed

| Method | Route | Permission | Description | |--------|-------|------------|-------------| | GET | /notifications/entity/{entityType}/{entityId} | Read | Activity feed for a specific entity |

Preferences

| Method | Route | Permission | Description | |--------|-------|------------|-------------| | GET | /notifications/preferences | Read | User’s delivery preferences | | PUT | /notifications/preferences | Manage | Create or update a preference | | GET | /notifications/types | Read | List all registered notification type definitions |

Subscriptions

| Method | Route | Permission | Description | |--------|-------|------------|-------------| | GET | /notifications/subscriptions | Read | User’s topic subscriptions | | POST | /notifications/subscriptions/{typeName} | Manage | Subscribe to a notification type | | DELETE | /notifications/subscriptions/{typeName} | Manage | Unsubscribe from a notification type |

Entity followers

| Method | Route | Permission | Description | |--------|-------|------------|-------------| | POST | /notifications/entity/{entityType}/{entityId}/follow | Manage | Follow an entity | | DELETE | /notifications/entity/{entityType}/{entityId}/follow | Manage | Unfollow an entity | | GET | /notifications/entity/{entityType}/{entityId}/followers | Read | List entity followers |

Mobile push tokens

Mapped separately via MapGranitMobilePushTokens() under api/notifications/mobile-push/tokens:

| Method | Route | Permission | Description | |--------|-------|------------|-------------| | POST | /api/notifications/mobile-push/tokens | Manage | Register a device token | | DELETE | /api/notifications/mobile-push/tokens/{deviceToken} | Manage | Remove a device token (owner-scoped) | | GET | /api/notifications/mobile-push/tokens | Read | List current user’s device tokens |

See also

• Overview — fan-out engine and setup
• Data model — entities behind these endpoints
• Configuration — health checks and OpenTelemetry tags
• SMS, push & real-time — channels behind the mobile push token endpoints
• Authorization module — permission gating for Manage and Read