Push Notifications API

Danvas exposes Web Push subscription and sending endpoints. A provider-accepted push is not a guarantee that a browser displayed or a user acknowledged the notification; delivery outcomes are governed by the notification operations runbook.

curl -X POST "https://example.com/api/push/subscribe" \
  -H "Content-Type: application/json" \
  -d '{
    "endpoint": "string",
    "keys": {
      "p256dh": "string",
      "auth": "string"
    }
  }'

{
  "success": true
}

curl -X DELETE "https://example.com/api/push/subscribe" \
  -H "Content-Type: application/json" \
  -d '{
    "endpoint": "string"
  }'

{
  "success": true,
  "deleted": true
}

curl -X POST "https://example.com/api/push/send" \
  -H "Content-Type: application/json" \
  -d '{}'

{
  "success": true,
  "sent": 0,
  "failed": 0,
  "expired": 0
}

Authentication and lifecycleCopy Anchor Link

• POST /api/push/subscribe creates or updates the authenticated caller’s current-device subscription.
• DELETE /api/push/subscribe removes only the authenticated caller’s subscription identified by endpoint; it cannot delete another user’s subscription.
• POST /api/push/send allows self-targeting. Targeting another targetUserId requires an admin role. The send URL must be a safe relative same-origin path.
• Expired subscriptions are removed before send, and stale 404/410 provider responses trigger cleanup. Subscribe/unsubscribe and send operations are rate-limited by the current route contracts.

VAPID KeysCopy Anchor Link

Push notifications use VAPID (Voluntary Application Server Identification) for security:

# Environment variables
NEXT_PUBLIC_VAPID_PUBLIC_KEY=<public key>
VAPID_PRIVATE_KEY=<private key>

Generate keys with:

npx web-push generate-vapid-keys

Notification displayCopy Anchor Link

When the browser receives a push, the service worker may display a native notification. Payload URLs must be relative app paths so notification clicks stay same-origin:

self.registration.showNotification(title, {
  body,
  icon: "/apple-icon.png",
  badge: "/favicon.ico",
  data: { url }
});

Related filesCopy Anchor Link