Deregister Device
Push Notification Endpoints
Deregister Device
Remove a device registration so the authenticated user stops receiving push notifications on it
Deregister Device
Removes the calling user’s push device registration. The device is identified the same way it was registered — by its token (iOS/Android) or subscription endpoint (Web).
Deregistration is idempotent. The endpoint returns
Returned when a service or master key is used. This endpoint has no
impersonation path by design (see Security note).
Returned while the
The deletion could not be performed. No diagnostic detail is returned; retry.
Rate limit: 50 requests per 5 minutes per IP. Exceeding it returns
200 whether or not a matching registration existed — the contract is “this binding is gone”, and it is equally gone if an earlier call removed it or it never existed. There is no not-found error.
Only the calling user’s own binding is removed. A device can be registered by several accounts at once, so deregistering unbinds the caller’s account from that device and leaves every other account’s binding on the same device intact — callers cannot deregister devices they don’t own.
Requires end-user authentication. Service and master keys are rejected for the same reason as Register Device.
Requires the push bundle.
Body Parameters
string
required
The device platform. One of
"ios", "android", or "web".string
The APNs or FCM device token. Required when
platform is "ios" or "android".object
The Web Push subscription object. Required when
platform is "web". The server uses only the endpoint field to identify the registration.Response
Returns200 on success, including when no matching registration existed.
Error Responses
No Credential — 401
No Credential — 401
Plain-text
Unauthorized, with no JSON body and no code. Returned when the
request carries no Authorization header at all.Rejected Credential — 403
Rejected Credential — 403
Plain-text
Forbidden, with no JSON body and no code. Returned when the
access token is malformed, has the wrong signature, or has expired — the
common case, since access tokens live 30 minutes. Refresh the access token
and retry; do not treat this as a permanent refusal.Service Key Rejected — 401
Service Key Rejected — 401
Invalid Body — 400
Invalid Body — 400
Bundle Not Installed — 403
Bundle Not Installed — 403
Bundle Provisioning — 503
Bundle Provisioning — 503
push bundle is mid-install. Retry shortly.Server Error — 500
Server Error — 500
429 with a plain-text message and no code.

