Public and webhooks

16 operations, each with its parameters, curl and TypeScript examples ready to copy, and its errors.

Operations marked /v1 authenticate with an agent token; the rest, with a panel session. How both work is in Authentication

`linkedDownloadInfo`

GET/_x/query/linked-download-info

No sessionPermission: public

linkedDownloadInfo

Parameters of linkedDownloadInfo
Name	In	Type	Required
`linkToken`	Query	`string`	Yes
`recipientToken`	Query	`string`	Yes
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/_x/query/linked-download-info?linkToken=<linkToken>&recipientToken=<recipientToken>'

TypeScript

const response = await fetch('https://www.notificado.co/_x/query/linked-download-info?linkToken=<linkToken>&recipientToken=<recipientToken>');
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
403 policy denied

`publicStatus`

GET/_x/query/public-status

No sessionPermission: publicMCP tool: publicStatus

Public status of notificado.co: status (operational | maintenance | degraded | partial_outage | major_outage), the incidents still open, one entry per America/Bogota day for the last 90 days with the worst impact that day, and every incident in that window with its public updates (Spanish, optional English). Instants are UTC.

Parameters of publicStatus
Name	In	Type	Required
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/_x/query/public-status'

TypeScript

const response = await fetch('https://www.notificado.co/_x/query/public-status');
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
403 policy denied

`publishedBlogPost`

GET/_x/query/published-blog-post

No sessionPermission: public

publishedBlogPost

Parameters of publishedBlogPost
Name	In	Type	Required
`locale`	Query	`"es-co" \| "en"`	Yes
`slug`	Query	`string 1–70`	Yes
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/_x/query/published-blog-post?locale=es-co&slug=<slug>'

TypeScript

const response = await fetch('https://www.notificado.co/_x/query/published-blog-post?locale=es-co&slug=<slug>');
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
403 policy denied

`publishedBlogPosts`

GET/_x/query/published-blog-posts

No sessionPermission: public

publishedBlogPosts

Parameters of publishedBlogPosts
Name	In	Type	Required
`before`	Query	`string 1–64`	No
`limit`	Query	`integer 1–101`	No
`locale`	Query	`"es-co" \| "en"`	Yes
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/_x/query/published-blog-posts?locale=es-co'

TypeScript

const response = await fetch('https://www.notificado.co/_x/query/published-blog-posts?locale=es-co');
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
403 policy denied

`recipientPage`

GET/_x/query/recipient-page

No sessionPermission: public

recipientPage

Parameters of recipientPage
Name	In	Type	Required
`recipientToken`	Query	`string 1–64`	Yes
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/_x/query/recipient-page?recipientToken=<recipientToken>'

TypeScript

const response = await fetch('https://www.notificado.co/_x/query/recipient-page?recipientToken=<recipientToken>');
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
403 policy denied

`verifyConstancia`

GET/v1/verify-constancia

No sessionPermission: public/v1 · bearer tokenMCP tool: verifyConstancia

Check a constancia by code or PDF SHA-256: authentic, issuedAt, version, superseded.

Parameters of verifyConstancia
Name	In	Type	Required
`captchaToken`	Query	`string 0–4096`	No
`cf-turnstile-response`	Query	`string 0–4096`	No
`code`	Query	`string 1–32`	No
`h-captcha-response`	Query	`string 0–4096`	No
`pdfSha256`	Query	`string`	No
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/v1/verify-constancia' \
  -H "authorization: Bearer $NOTIFICADO_TOKEN"

TypeScript

const response = await fetch('https://www.notificado.co/v1/verify-constancia', {
  headers: { authorization: `Bearer ${token}` },
});
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
403 policy denied

`acknowledgeReceipt`

POST/api/acknowledge-receipt

No sessionPermission: public

acknowledgeReceipt

Parameters of acknowledgeReceipt
Name	In	Type	Required
`recipientToken`	Body	`string 1–64`	Yes

curl

curl -X POST 'https://www.notificado.co/api/acknowledge-receipt' \
  -H 'content-type: application/json' \
  -d '{"recipientToken":"<recipientToken>"}'

TypeScript

const response = await fetch('https://www.notificado.co/api/acknowledge-receipt', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    "recipientToken": "<recipientToken>"
  }),
});
const result = await response.json();

Example response

200

{
  "acknowledgedAt": "<acknowledgedAt>",
  "created": true,
  "eventId": "<eventId>",
  "ok": true
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`confirmDataSubjectRequest`

POST/api/confirm-data-subject-request

No sessionPermission: public

confirmDataSubjectRequest

Parameters of confirmDataSubjectRequest
Name	In	Type	Required
`reference`	Body	`string 12–12`	Yes
`token`	Body	`string 16–128`	Yes

curl

curl -X POST 'https://www.notificado.co/api/confirm-data-subject-request' \
  -H 'content-type: application/json' \
  -d '{"reference":"<reference>","token":"<token>"}'

TypeScript

const response = await fetch('https://www.notificado.co/api/confirm-data-subject-request', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    "reference": "<reference>",
    "token": "<token>"
  }),
});
const result = await response.json();

Example response

200

{
  "reference": "<reference>",
  "verified": true
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`fileDataSubjectRequest`

POST/api/file-data-subject-request

No sessionPermission: public

fileDataSubjectRequest

Parameters of fileDataSubjectRequest
Name	In	Type	Required
`captchaToken`	Body	`string 0–4096`	No
`cf-turnstile-response`	Body	`string 0–4096`	No
`documentNumber`	Body	`string 3–40`	Yes
`documentType`	Body	`"cc" \| "ce" \| "pasaporte" \| "nit" \| "otro"`	Yes
`email`	Body	`string (email)`	Yes
`fullName`	Body	`string 2–200`	Yes
`h-captcha-response`	Body	`string 0–4096`	No
`kind`	Body	`"consulta" \| "reclamo" \| "actualizacion" \| "supresion"`	Yes
`locale`	Body	`string 0–16`	No
`message`	Body	`string 10–5000`	Yes
`phone`	Body	`string 0–40`	No
`relatedTo`	Body	`string 0–300`	No
`subject`	Body	`"recipient" \| "account"`	Yes
`website`	Body	`string 0–500`	No

curl

curl -X POST 'https://www.notificado.co/api/file-data-subject-request' \
  -H 'content-type: application/json' \
  -d '{
  "documentNumber": "<documentNumber>",
  "documentType": "cc",
  "email": "<email>",
  "fullName": "<fullName>",
  "kind": "consulta",
  "message": "<message>",
  "subject": "recipient"
}'

TypeScript

const response = await fetch('https://www.notificado.co/api/file-data-subject-request', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    "documentNumber": "<documentNumber>",
    "documentType": "cc",
    "email": "<email>",
    "fullName": "<fullName>",
    "kind": "consulta",
    "message": "<message>",
    "subject": "recipient"
  }),
});
const result = await response.json();

Example response

200

{
  "dueAt": "2026-09-25T15:00:00Z",
  "mailDelayed": true,
  "reference": "<reference>"
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`epaycoPayoutsWebhook`

POST/api/payouts-webhooks/epayco

No sessionPermission: public

epaycoPayoutsWebhook

Parameters of epaycoPayoutsWebhook
Name	In	Type	Required
`data`	Body	`object`	Yes

curl

curl -X POST 'https://www.notificado.co/api/payouts-webhooks/epayco' \
  -H 'content-type: application/json' \
  -d '{"data":{}}'

TypeScript

const response = await fetch('https://www.notificado.co/api/payouts-webhooks/epayco', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    "data": {}
  }),
});
const result = await response.json();

Example response

200

{
  "eventKey": "<eventKey>",
  "outcome": "queued"
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`ingestPostmarkEvent`

POST/api/postmark-events/ingest

No sessionPermission: public

ingestPostmarkEvent

Parameters of ingestPostmarkEvent
Name	In	Type	Required
`MessageID`	Body	`string 1–200`	No
`RecordType`	Body	`string 1–60`	No

curl

curl -X POST 'https://www.notificado.co/api/postmark-events/ingest' \
  -H 'content-type: application/json' \
  -d '{}'

TypeScript

const response = await fetch('https://www.notificado.co/api/postmark-events/ingest', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({}),
});
const result = await response.json();

Example response

200

{
  "key": "<key>",
  "outcome": "queued",
  "rawKey": "<rawKey>",
  "receiptKey": "<receiptKey>"
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`recordDownload`

POST/api/record-download

No sessionPermission: public

recordDownload

Parameters of recordDownload
Name	In	Type	Required
`linkToken`	Body	`string`	Yes
`recipientToken`	Body	`string`	Yes

curl

curl -X POST 'https://www.notificado.co/api/record-download' \
  -H 'content-type: application/json' \
  -d '{"linkToken":"<linkToken>","recipientToken":"<recipientToken>"}'

TypeScript

const response = await fetch('https://www.notificado.co/api/record-download', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    "linkToken": "<linkToken>",
    "recipientToken": "<recipientToken>"
  }),
});
const result = await response.json();

Example response

200

{
  "bytes": 0,
  "contentBase64": "<contentBase64>",
  "contentType": "<contentType>",
  "eventId": "<eventId>",
  "filename": "<filename>",
  "sha256": "<sha256>"
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`recordMailClick`

POST/api/record-mail-click

Firm memberPermission: mailtrack:public-link

recordMailClick

Parameters of recordMailClick
Name	In	Type	Required
`id`	Body	`string 1–64`	Yes
`n`	Body	`integer 1–1000`	Yes

curl

curl -X POST 'https://www.notificado.co/api/record-mail-click' \
  -b cookies.txt \
  -H 'origin: https://www.notificado.co' \
  -H 'content-type: application/json' \
  -d '{"id":"<id>","n":1}'

TypeScript

const response = await fetch('https://www.notificado.co/api/record-mail-click', {
  method: 'POST',
  headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
  body: JSON.stringify({
    "id": "<id>",
    "n": 1
  }),
});
const result = await response.json();

Example response

200

{
  "location": "<location>",
  "recorded": true
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

POST/api/report-abuse

No sessionPermission: public

reportAbuse

Parameters of reportAbuse
Name	In	Type	Required
`details`	Body	`string 0–2000`	No
`reason`	Body	`"phishing" \| "not_expected" \| "wrong_recipient" \| "harassment" \| "other"`	Yes
`recipientToken`	Body	`string 1–64`	Yes

curl

curl -X POST 'https://www.notificado.co/api/report-abuse' \
  -H 'content-type: application/json' \
  -d '{"reason":"phishing","recipientToken":"<recipientToken>"}'

TypeScript

const response = await fetch('https://www.notificado.co/api/report-abuse', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    "reason": "phishing",
    "recipientToken": "<recipientToken>"
  }),
});
const result = await response.json();

Example response

200

{
  "created": true,
  "ok": true
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`trackReferralClick`

POST/api/track-referral-click

No sessionPermission: affiliate:track-click

Record a click on a referral link (the /registro?ref= landing). Anyone may call it; rate-limited, and only hashes are stored.

Parameters of trackReferralClick
Name	In	Type	Required
`code`	Body	`string 1–40`	Yes
`landingPath`	Body	`string 1–300`	Yes

curl

curl -X POST 'https://www.notificado.co/api/track-referral-click' \
  -H 'content-type: application/json' \
  -d '{"code":"<code>","landingPath":"<landingPath>"}'

TypeScript

const response = await fetch('https://www.notificado.co/api/track-referral-click', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    "code": "<code>",
    "landingPath": "<landingPath>"
  }),
});
const result = await response.json();

Example response

200

{
  "outcome": "recorded"
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`epaycoWebhook`

POST/api/webhooks/epayco

No sessionPermission: public

epaycoWebhook

Parameters of epaycoWebhook
Name	In	Type	Required
`x_ref_payco`	Body	`string 1–40 \| number`	Yes
`x_signature`	Body	`string 1–128`	Yes

curl

curl -X POST 'https://www.notificado.co/api/webhooks/epayco' \
  -H 'content-type: application/json' \
  -d '{"x_ref_payco":"<x_ref_payco>","x_signature":"<x_signature>"}'

TypeScript

const response = await fetch('https://www.notificado.co/api/webhooks/epayco', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    "x_ref_payco": "<x_ref_payco>",
    "x_signature": "<x_signature>"
  }),
});
const result = await response.json();

Example response

200

{
  "eventKey": "<eventKey>",
  "outcome": "queued"
}

Errors

400 X_INPUT_INVALID
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

Preferences

Language

Appearance

Public and webhooks

`linkedDownloadInfo`

`publicStatus`

`publishedBlogPost`

`publishedBlogPosts`

`recipientPage`

`verifyConstancia`

`acknowledgeReceipt`

`confirmDataSubjectRequest`

`fileDataSubjectRequest`

`epaycoPayoutsWebhook`

`ingestPostmarkEvent`

`recordDownload`

`recordMailClick`

`trackReferralClick`

`epaycoWebhook`