Device Tokens

Push notification tokens for the caller's devices (Android/iOS). The apps register their token so the backend can deliver push notifications, and unregister it on logout/uninstall. Paths are relative to the /api/v1 prefix; all routes require Authorization: Bearer {token}.

See Common errors.

Endpoints

Method	URI	Role	Description
`POST`	`/device-tokens`	any	Register (or refresh) a device push token
`DELETE`	`/device-tokens`	any	Unregister a device push token

POST /device-tokens

Registers (or updates) the device push token for the caller.

Request body

Field	Type	Required	Rules
`token`	string	yes	1–512 chars
`platform`	string	yes	one of `android`, `ios`

Response 201

{
  "device_token": {
    "id": 12,
    "platform": "android"
  }
}

Errors

Status	Body	When
`422`	`{ "error": "ValidationError", "details": { "fieldErrors": { … } } }`	Missing/invalid `token` or `platform`

DELETE /device-tokens

Unregisters one of the caller's device push tokens.

Request body

Field	Type	Required	Rules
`token`	string	yes	—

Response 200 — { "ok": true }. Idempotent: succeeds even if the token was not registered for the caller.

Errors

Status	Body	When
`422`	`{ "error": "ValidationError", "details": { "fieldErrors": { "token": [ … ] } } }`	Missing `token`

Examples

# Register an Android token
curl -X POST /api/v1/device-tokens \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"token": "fcm-token-abc", "platform": "android"}'

# Unregister it on logout
curl -X DELETE /api/v1/device-tokens \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"token": "fcm-token-abc"}'