Get notification channel preferences
/notifications/preferencesAuthorizationBearer token (JWT) · headerrequiredJWT issued by the external IdP via the OAuth 2.0 authorization-code flow (Kinde in
production; a simulator in test). The client obtains it and sends it as a Bearer token on
every authenticated call. Sarvex's services verify it — issuer, audience, signature
(IdP JWKS), expiry — and read identity and tenant from its claims. Sarvex does not issue
or revoke these tokens. merchant_id/store_id are read from the verified claims (and the
merchant→store mapping), never from the URL. The operator scope is required for
/operator/*. Operators acting on a specific merchant pass the X-Operate-As header,
which is recorded in the audit log.
Preferences.
email_enabledbooleanweekly_digestbooleanalert_emailstring<email> | nullalert_recipientsstring<email>[]Recipients for endpoint-health alert delivery. Additive to alert_email, which nothing else in the codebase reads yet.
alert_severity_floorstringAlerts below this severity are not delivered. Defaults to critical (opt in to degraded).
degradedcriticalquiet_hours_start_hourinteger | nullquiet_hours_end_hourinteger | nullquiet_hours_timezonestringIANA timezone name.