API - Notifier

Sending messages

Apps registered by an admin can send one-way messages to a specific user. Users never reply through the API - this is a receive-only integration.

1. An admin registers your app from /Admin and gives you an app token (shown to them once).

2. Each person who wants to receive your messages finds their own User Key on their Profile page and gives it to you. Anyone with your app token can message any user who has shared their key with you - there's no per-app allowlist beyond that.

Send a message

POST /api/v1/messages
Authorization: Bearer <app token>
Content-Type: application/json

{
  "userKey": "user_...",
  "title": "Disk space low",
  "body": "/data is at 92% capacity"
}

Field	Required	Notes
`userKey`	Yes	The recipient's User Key, from their Profile page.
`title`	Yes	Shown in bold in the message and in the push notification.
`body`	No	Plain text only - no images or attachments.

Response	Meaning
`200`	`{ "id": 123 }` - message stored and, if the user has a device subscribed, a push notification was attempted.
`400`	`userKey` or `title` was missing.
`401`	Missing/invalid bearer token, or the app has been disabled by the admin.
`404`	No user with that `userKey`.

A push notification is best-effort: the message is always saved and visible in-app even if the device can't currently be reached.

Example

curl -X POST https://your-notifier-domain/api/v1/messages \
  -H "Authorization: Bearer app_..." \
  -H "Content-Type: application/json" \
  -d '{"userKey":"user_...","title":"Backup complete","body":"12.4 GB backed up"}'

Admin API

Scriptable equivalents of what an admin can already do from /Admin - create users, manage app tokens, and change a user's password. Authenticated with a separate admin API token, generated only from /Admin/Settings by a logged-in admin - not related to any app token or User Key.

Authorization: Bearer <admin API token>

Endpoint	Body	Returns
`GET /api/v1/admin/users`	-	Array of `{ id, displayName, email, userKey }`
`POST /api/v1/admin/users`	`{ displayName, email, password }`	`{ id, userKey }`
`POST /api/v1/admin/users/{id}/password`	`{ newPassword }`	`200 OK`
`GET /api/v1/admin/apps`	-	Array of `{ id, name, enabled, createdAt }` - no tokens
`POST /api/v1/admin/apps`	`{ name }`	`{ id, name, token }` - the token, once
`POST /api/v1/admin/apps/{id}/regenerate-token`	-	`{ id, token }` - the new token, once

Like app tokens, a newly created or regenerated app token is only ever returned once, in that same response - there's no endpoint to fetch an existing one back out later.

curl -X POST https://your-notifier-domain/api/v1/admin/users \
  -H "Authorization: Bearer admin_..." \
  -H "Content-Type: application/json" \
  -d '{"displayName":"Jane Doe","email":"jane@example.com","password":"hello123"}'