List the authenticated user's inbox

GET/api/notifications

listNotifications

Returns the recipient's inbox newest-first plus the live unread count for the nav badge. Filters by archive/read status. The inbox is partitioned by `recipient_id` so this is partition-pruned.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/notifications' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN'

fetch

fetch("https://neosource.dev/api/notifications", {
  method: "GET",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
  },
});

Query parameters

include_archived: Include archived notifications (default: false).
boolean
only_unread: Only return unread notifications (default: false).
boolean
limit: Maximum rows to return; clamped server-side.
integerint64
owner: Scope the inbox to this workspace slug. Omit for all workspaces (the cross-workspace "All" view). An unknown slug is ignored and falls back to all workspaces.
string

Responses

200Inbox

application/json

NotificationListResponse

object

notificationsrequired

array

items

NotificationResponse

object

actor_id: string | null
archived_at: integer | nullint64
created_atrequired: integerint64
link: string | null
notification_idrequired: string
read_at: integer | nullint64
reasonrequired: NotificationReason
recipient_idrequired: string
subject_idrequired: string
subject_kindrequired: NotificationSubject
summaryrequired: string

unread_countrequired

integerint64

Number of unread, un-archived rows for this user — what the nav badge displays. Returned alongside the list so the SPA can keep the badge accurate without a second round-trip.

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

`NotificationReason`

string

Why the recipient is being notified. v1 surface — see roadmap §10. Stored as the Postgres enum `notification_reason`; adding a variant needs an `ALTER TYPE … ADD VALUE` migration plus the mirrored `NotificationReasonDb` arm in storage-pg.

"mention""review_requested""assigned""blocked_cleared""authored_thing_updated""run_failed"

`NotificationSubject`

string

What is the recipient being notified about? Polymorphic tag mirroring the `subject_kind` column.

"issue""pull_request""comment""pr_review_thread""workflow_run"