Depot handler

View as Markdown Open in ChatGPT Open in Claude

Registers the whole route set at base.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET `/status`

GETNo permission neededpublic facehosteditmspremoteIdempotentNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

Serve page

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/status.json`

GETNo permission neededpublic facehosteditmspremoteIdempotentNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

Serve summary

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status.json'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status.json'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status.json"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status.json", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status.json";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status.json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/status/app.js`

GETNo permission neededpublic facehosteditmspremoteIdempotentNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

Serve app JS

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status/app.js'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status/app.js'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status/app.js"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status/app.js", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status/app.js";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status/app.js");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/status/confirm/{token}`

GETNo permission neededpublic facehosteditmspremoteIdempotentToken in the pathNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

serveConfirm completes a double opt-in.

SINGLE USE IS THE STORE’S JOB, in the UPDATE’s own predicate: it matches on the hash and NULLs it in the same write, so a replayed link matches nothing. A read here followed by a write would be a race two clicks apart, and worse, would let a spent link be told apart from an unknown one by timing.

Parameters

Name	In	Type	Required	Description
`token`	path	string	Yes

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status/confirm/<token>'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status/confirm/<token>'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status/confirm/<token>"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status/confirm/<token>", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status/confirm/<token>";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status/confirm/<token>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/status/feed.xml`

GETNo permission neededpublic facehosteditmspremoteIdempotentNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

Serve feed

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status/feed.xml'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status/feed.xml'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status/feed.xml"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status/feed.xml", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status/feed.xml";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status/feed.xml");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/status/files/{fileId}`

GETNo permission neededpublic facehosteditmspremoteIdempotentdownloadNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

serveFile streams one published incident file.

Parameters

Name	In	Type	Required	Description
`fileId`	path	string	Yes

Responses

Status	Body	Description
`200`	`application/octet-stream`, string (binary)	Success. The body shape was not resolved; see x-outpost-unresolved.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status/files/<fileId>'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status/files/<fileId>'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status/files/<fileId>"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status/files/<fileId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status/files/<fileId>";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status/files/<fileId>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/status/logo`

GETNo permission neededpublic facehosteditmspremoteIdempotentdownloadNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

serveLogo streams the tenant’s own logo.

“Cache-Control: public” is the same reasoning branding.go’s download half states: the image is deliberately shown to strangers, and the only thing that varies it is which page it is on, which is part of every cache key there is. The stored content type is echoed because it was checked against a closed allowlist at upload, and it is served inline because being rendered in an <img> is the file’s entire purpose - both safe here for exactly the reason they are unsafe for an incident file, which was uploaded rather than chosen from three raster formats.

Responses

Status	Body	Description
`200`	`application/octet-stream`, string (binary)	Success. The body shape was not resolved; see x-outpost-unresolved.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status/logo'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status/logo'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status/logo"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status/logo", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status/logo";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status/logo");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/status/preferences/{token}`

GETNo permission neededpublic facehosteditmspremoteIdempotentToken in the pathNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

servePreferencesForm shows the checkboxes.

Parameters

Name	In	Type	Required	Description
`token`	path	string	Yes

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status/preferences/<token>'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status/preferences/<token>'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status/preferences/<token>"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status/preferences/<token>", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status/preferences/<token>";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status/preferences/<token>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/status/preferences/{token}`

POSTNo permission neededpublic facehosteditmspremoteToken in the pathNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

servePreferences replaces the whole set.

REPLACE AND NOT MERGE. The form posts every box that is ticked, so an absent id means “unticked” and a merge would make it impossible to ever remove one. An empty set clears the preferences back to the schema’s default, which is subscribed to everything - not subscribed to nothing, which is what an unsubscribe is for and is a different button.

Parameters

Name	In	Type	Required	Description
`token`	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
`channel`required	`string`
`componentIds`required	`array of string`
`email`required	`string`
`slackWebhookUrl`required	`string`

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.
`400`	`application/problem+json`, ProblemDetails	The request body is not acceptable.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
curl -X POST 'https://depot.example.com/status/preferences/<token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data '{
  "channel": "string",
  "componentIds": [
    "string"
  ],
  "email": "string",
  "slackWebhookUrl": "string"
}'

# This operation is public. It takes no credentials.

$headers = @{
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
}

$body = @'
{
  "channel": "string",
  "componentIds": [
    "string"
  ],
  "email": "string",
  "slackWebhookUrl": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/status/preferences/<token>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.

import requests

url = "https://depot.example.com/status/preferences/<token>"
headers = {
    "Accept": "application/json",
    "Content-Type": "application/json",
}
payload = {
    "channel": "string",
    "componentIds": [
        "string",
    ],
    "email": "string",
    "slackWebhookUrl": "string",
}

response = requests.post(url, headers=headers, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "channel": "string",
  "componentIds": [
    "string"
  ],
  "email": "string",
  "slackWebhookUrl": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/status/preferences/<token>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.

const url = "https://depot.example.com/status/preferences/<token>";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "channel": "string",
    "componentIds": [
      "string"
    ],
    "email": "string",
    "slackWebhookUrl": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "channel": "string",
  "componentIds": [
    "string"
  ],
  "email": "string",
  "slackWebhookUrl": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/status/preferences/<token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/status/style.css`

GETNo permission neededpublic facehosteditmspremoteIdempotentNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

Serve style CSS

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status/style.css'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status/style.css'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status/style.css"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status/style.css", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status/style.css";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status/style.css");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/status/subscribe`

POSTNo permission neededpublic facehosteditmspremote

Source: [object Object]

Serve subscribe

Request body

Required, sent as application/json.

Field	Type	Description
`channel`required	`string`
`componentIds`required	`array of string`
`email`required	`string`
`slackWebhookUrl`required	`string`

Responses

Status	Body	Description
`202`	None	Accepted.
`400`	`application/problem+json`, ProblemDetails	The request body is not acceptable.

Request samples

# This operation is public. It takes no credentials.
curl -X POST 'https://depot.example.com/status/subscribe' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data '{
  "channel": "string",
  "componentIds": [
    "string"
  ],
  "email": "string",
  "slackWebhookUrl": "string"
}'

# This operation is public. It takes no credentials.

$headers = @{
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
}

$body = @'
{
  "channel": "string",
  "componentIds": [
    "string"
  ],
  "email": "string",
  "slackWebhookUrl": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/status/subscribe' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.

import requests

url = "https://depot.example.com/status/subscribe"
headers = {
    "Accept": "application/json",
    "Content-Type": "application/json",
}
payload = {
    "channel": "string",
    "componentIds": [
        "string",
    ],
    "email": "string",
    "slackWebhookUrl": "string",
}

response = requests.post(url, headers=headers, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "channel": "string",
  "componentIds": [
    "string"
  ],
  "email": "string",
  "slackWebhookUrl": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/status/subscribe", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.

const url = "https://depot.example.com/status/subscribe";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "channel": "string",
    "componentIds": [
      "string"
    ],
    "email": "string",
    "slackWebhookUrl": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "channel": "string",
  "componentIds": [
    "string"
  ],
  "email": "string",
  "slackWebhookUrl": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/status/subscribe");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/status/unsubscribe/{token}`

GETNo permission neededpublic facehosteditmspremoteIdempotentToken in the pathNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

serveUnsubscribeForm shows the button.

A GET NEVER UNSUBSCRIBES ANYBODY; see decision 5 in handler.go’s header.

Parameters

Name	In	Type	Required	Description
`token`	path	string	Yes

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/status/unsubscribe/<token>'

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/status/unsubscribe/<token>'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/status/unsubscribe/<token>"

response = requests.get(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/status/unsubscribe/<token>", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/status/unsubscribe/<token>";

const response = await fetch(url, {
  method: "GET",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/status/unsubscribe/<token>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/status/unsubscribe/{token}`

POSTNo permission neededpublic facehosteditmspremoteToken in the pathNot fully resolved

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

serveUnsubscribe performs it.

IDEMPOTENT AND THE TOKEN IS NEVER CONSUMED. Every unsubscribe link ever mailed stays valid, because a link that stopped working is how somebody who wanted to leave quietly becomes a spam complaint instead. The store COALESCEs the timestamp, so a second click a year later cannot rewrite when they actually left - which is the evidence for “we stopped mailing them when they asked”.

This is also the RFC 8058 one-click endpoint: Gmail and Yahoo POST “List-Unsubscribe=One-Click” here from their own infrastructure. The body is read under a cap and discarded, which is what makes both callers work through one handler.

Parameters

Name	In	Type	Required	Description
`token`	path	string	Yes

Responses

Status	Body	Description
`200`	None	Success. The body shape was not resolved; see x-outpost-unresolved.
`404`	`text/plain`, string	The request was refused.

Request samples

# This operation is public. It takes no credentials.
curl -X POST 'https://depot.example.com/status/unsubscribe/<token>'

# This operation is public. It takes no credentials.

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/status/unsubscribe/<token>'

$response | ConvertTo-Json -Depth 10

# This operation is public. It takes no credentials.

import requests

url = "https://depot.example.com/status/unsubscribe/<token>"

response = requests.post(url, timeout=30)
response.raise_for_status()
print(response.json())

// This operation is public. It takes no credentials.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/status/unsubscribe/<token>", nil)
  if err != nil {
    log.Fatal(err)
  }

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// This operation is public. It takes no credentials.

const url = "https://depot.example.com/status/unsubscribe/<token>";

const response = await fetch(url, {
  method: "POST",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// This operation is public. It takes no credentials.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/status/unsubscribe/<token>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.

Depot handler

GET /status

Responses

Request samples

GET /status.json

Responses

Request samples

GET /status/app.js

Responses

Request samples

GET /status/confirm/{token}

Parameters

Responses

Request samples

GET /status/feed.xml

Responses

Request samples

GET /status/files/{fileId}

Parameters

Responses

Request samples

GET /status/logo

Responses

Request samples

GET /status/preferences/{token}

Parameters

Responses

Request samples

POST /status/preferences/{token}

Parameters

Request body

Responses

Request samples

GET /status/style.css

Responses

Request samples

POST /status/subscribe

Request body

Responses

Request samples

GET /status/unsubscribe/{token}

Parameters

Responses

Request samples

POST /status/unsubscribe/{token}

Parameters

Responses

Request samples

GET `/status`

GET `/status.json`

GET `/status/app.js`

GET `/status/confirm/{token}`

GET `/status/feed.xml`

GET `/status/files/{fileId}`

GET `/status/logo`

GET `/status/preferences/{token}`

POST `/status/preferences/{token}`

GET `/status/style.css`

POST `/status/subscribe`

GET `/status/unsubscribe/{token}`

POST `/status/unsubscribe/{token}`