ClaudeMon.
Browse API docsKeys and email alerts
API/Reference/Keys and email alerts

Keys and email subscriptions

Create verified-email keys, choose alert filters and stop delivery when you need to.

Get a key

  1. Send a JSON email field to POST /api/v1/keys. It answers 202 with status: accepted and a detail message, without revealing whether the address already has a key. Delivery is not guaranteed by that response; a deployment without its mailer configured sends nothing.
  2. Open the single-use link in the email within 30 minutes. GET shows a confirmation form; scanners cannot spend the token by fetching it.
  3. Submit the form to POST /keys/verify with its token field. The HTML response shows the new cm_live_ key once. Store it securely; it cannot be retrieved later. Invalid, expired and used tokens answer 400.
  4. Send the key as Authorization: Bearer cm_live_.... Invalid or revoked keys answer 401. DELETE the calling key at /api/v1/keys/me to revoke it immediately; it cannot authenticate again.

Key pages and key/subscription responses are private and no-store. Key and subscription writes use JSON; verification uses a regular form. All API requests follow the rate limits.

Request a link
curl -X POST 'https://claudemon.com/api/v1/keys' -H 'Content-Type: application/json' -d '{"email":"you@example.com"}'

Endpoint reference

Method and pathAuthorizationResponse
POST /api/v1/keysNo key202 accepted; 400 invalid email; 429 limited
GET /keys/verify?token={token}Email link200 confirmation page; 400 malformed link
POST /keys/verifyForm token200 key shown once; 400 spent or expired link
GET /api/v1/keys/meBearer key200 key metadata
DELETE /api/v1/keys/meBearer key200 revoked key ID and revoked_at
POST /api/v1/subscriptionsBearer key201 created; 200 identical active subscription; 409 cap
GET /api/v1/subscriptionsBearer key200 all this key's subscriptions, including disabled
DELETE /api/v1/subscriptions/{id}Owning key200 disabled subscription; 404 missing or another key's ID
GET /alerts/unsubscribe?token={token}Signed email link200 confirmation page
POST /alerts/unsubscribe?token={token}Signed email link200 unsubscribed; 400 invalid signature

The API responses below are JSON. Verification and unsubscribe pages return HTML. API errors use problem+json; missing or invalid bearer keys return 401. Repeated scalar presentation parameters can return 400 before the route.

Create an email subscription

POST a JSON object to /api/v1/subscriptions. channel is optional and accepts only email. filters is optional and defaults to the values below. Unknown body/filter fields return 400. Write bodies are limited to 8192 bytes, including streamed requests; larger bodies return 413. The destination is always the key's verified email address; a client cannot supply another recipient.

  • labs: an array of anthropic, openai, google, xai or meta. Empty means every lab. Duplicates are removed and the array is sorted.
  • kinds: a nonempty array of deprecation or incident; defaults to both.
  • min_impact: critical, major, minor or maintenance, default minor. It applies only to incidents; unknown upstream impact is treated as minor. Resolution matching uses the occurrence’s peak observed impact, so a downgrade does not suppress its closing notice. A reopened occurrence starts a new peak.

A key may have 10 active subscriptions. An identical active normalized filter set returns the existing subscription with 200, including on retries; a new subscription returns 201 with a Location header. At the cap, a different filter set returns 409. Each key retains at most 100 subscription records including disabled history; creating more returns 409 when that history is full. Disabled subscription records are retained; another key has its own allowance.

Subscription body
{
  "channel": "email",
  "filters": {
    "labs": [],
    "kinds": [
      "deprecation",
      "incident"
    ],
    "min_impact": "minor"
  }
}
Create
curl -X POST 'https://claudemon.com/api/v1/subscriptions' -H 'Authorization: Bearer YOUR_KEY' -H 'Content-Type: application/json' -d '{"filters":{"labs":["openai"],"kinds":["incident"],"min_impact":"major"}}'

Response shapes

GET /api/v1/keys/me returns { data: key }. Key fields are id, prefix, email, created_at, last_used_at or request_count; the secret is never returned. DELETE returns { data: { id, revoked_at } }.

Create and delete subscription calls return { data: subscription }. GET /api/v1/subscriptions returns { data: [subscription] }, without pagination (at most 100 records). Each subscription has id, channel, destination, filters, verified_at, created_at or disabled_at. A null disabled_at means active; deletion disables rather than removes the record. Timestamps are ISO 8601 UTC.

Stop alerts

DELETE /api/v1/subscriptions/{id} with the owning bearer key to disable one subscription. Revoking a key also stops its subscriptions from sending. Token confirmation and unsubscribe routes apply IP limits before token processing and return 429 with Retry-After when exceeded.

Every alert includes a signed unsubscribe URL. GET asks for confirmation; POST disables that subscription. The same POST endpoint accepts the mail client's List-Unsubscribe=One-Click form body with its signed token in the query, without an API key. A changed signature answers 400.

Alerts cover newly observed deprecations and incident openings, escalations and resolutions. Imports, corrections, events older than the subscription and events outside the one-hour delivery window do not send. Delivery retries keep the same request and stop after the retry/age limit.

Related