Forget where to show this device alerts
Call on sign-out, or when notification permission is withdrawn. Idempotent: clearing a device that has no alert token still answers 204.
Authorization
deviceAuth A per-device secret issued by POST /v1/devices/enroll, presented as
Authorization: Device <secret>.
A distinct scheme rather than another bearer flavour: the bearer namespace already carries workspace API keys and session JWTs, and a device secret authorises far less than either — it can mint a WebRTC token for its own identity and report presence, and nothing else.
In: header
Response Body
curl -X DELETE "https://example.com/v1/devices/alert-token"Record where to show this device a message alert PUT
Not the push token. The push token wakes the device for a call (a PushKit VoIP token on iOS, an FCM token on Android). The alert token is a regular APNs token (iOS) that draws a banner for a message or mention. A device carries both, because they are different addresses for different pushes. Call this on every launch: the token rotates silently on reinstall, restore and app-data clear. It is stored as given and never returned by any endpoint.
Report this device as reachable POST
Call every 30 seconds while the app is able to take calls. A device that stops beating leaves the extension's fan-out within about a minute; the line's other devices are unaffected.