Issue preference-centre link

Outcome

Issue a signed preference-centre link for one active contact, valid for 365 days. The page (GET never changes state) lists the workspace's active topics with the contact's state; its buttons POST the token to subscribe to a topic (always double opt-in), unsubscribe from a topic, or unsubscribe from everything (a topic-less unsubscribed ledger event, the global opt-out). The token is a topic-less unsubscribe token, so the link also works with the one-click unsubscribe endpoint. Nothing is stored and links cannot be revoked individually; deliver it only to the contact's own address.

Before you start

• Verify identity and pin the intended organization and environment before discovering the action.
• Discover a granted Nurture workspace. The application permission is workspace:write; required workspace access is read_write. A permission alone does not supply a workspace grant.
• Organization and workspace come from verified context. Select resourceType/resourceId separately from action input; body fields cannot grant a different organization or workspace. The first authorized product action can initialize an identity-only workspace mirror.
• Obtain authorization for the documented effect or personal-data export before supplying CLI --confirm or MCP confirm:true.

Discover the target

topolo whoami --json
topolo actions get app_topolo_nurture.subscriptions.preference_link --detail --json
topolo resources topolo-nurture --json
topolo workspaces list topolo-nurture --json
topolo actions get app_topolo_nurture.contacts.list --detail --json

• id: Nurture contact id in the selected workspace.

Request

POST /api/contacts/{id}/preference-link

Save action input as payload.json. The reviewed plan separates path identifiers, query fields and HTTP body. Set NURTURE_WORKSPACE_ID from granted resource discovery; it is separate from action input.

Inspect and test this action in the signed action console. A test response still requires the verification below.

Input fields

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64
    }
  },
  "required": [
    "id"
  ],
  "additionalProperties": false
}

Effects

• Signs and returns a link; no record is written and nothing is sent to the contact.

Interpret the response

The returned identifier path is $.contactId for contact. Empty lists do not discover a target.

Confirm $.preferenceUrl starts with the Nurture public origin and contains /api/public/preferences?token=.

Exact success schema:

{
  "type": "object",
  "required": [
    "contactId",
    "preferenceUrl",
    "expiresAt"
  ],
  "properties": {
    "contactId": {
      "type": "string"
    },
    "preferenceUrl": {
      "type": "string"
    },
    "expiresAt": {
      "type": "string"
    }
  }
}

Worked examples

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Replace synthetic identifiers using credential-scoped discovery. A local success is not evidence of a deployed effect, configured provider or delivered message.

Successful request

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{
  "id": "nct_c5021d90669b4dd6b0797a5b66d47e48"
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.preference_link --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.preference_link --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.subscriptions.preference_link --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.subscriptions.preference_link",
    "input": {
      "id": "nct_c5021d90669b4dd6b0797a5b66d47e48"
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "contactId": "nct_c5021d90669b4dd6b0797a5b66d47e48",
  "preferenceUrl": "https://nurture.test/api/public/preferences?token=eyJ2IjoxLCJrIjoidW5zdWIiLCJvIjoib3JnX2EiLCJ3Ijoid3NfYSIsImMiOiJuY3RfYzUwMjFkOTA2NjliNGRkNmIwNzk3YTViNjZkNDdlNDgiLCJuIjoibl9hODUwNzEzNDNiMTQ0NTM5YjMzYjZhNDMyOTc2N2FiYSIsImNoIjoiZW1haWwiLCJlIjoxODIyNjA5OTU0NTM0fQ.VAQgqjXw6HqmF6cN9f_oIXKUigQntZXSlpJGCj_Cmrs",
  "expiresAt": "2027-10-04T00:32:34.534Z"
}

HTTP 200. Confirm $.preferenceUrl starts with the Nurture public origin and contains /api/public/preferences?token=.

Another supported request

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{
  "id": "nct_9cfbe6705a864086b554988f33f98f11"
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.preference_link --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.preference_link --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.subscriptions.preference_link --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.subscriptions.preference_link",
    "input": {
      "id": "nct_9cfbe6705a864086b554988f33f98f11"
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "contactId": "nct_9cfbe6705a864086b554988f33f98f11",
  "preferenceUrl": "https://nurture.test/api/public/preferences?token=eyJ2IjoxLCJrIjoidW5zdWIiLCJvIjoib3JnX2EiLCJ3Ijoid3NfYSIsImMiOiJuY3RfOWNmYmU2NzA1YTg2NDA4NmI1NTQ5ODhmMzNmOThmMTEiLCJuIjoibl81ZTBjZTkyZWJlMGY0MWMxYTcwNTdiOGFhNjAyNDg1MiIsImNoIjoiZW1haWwiLCJlIjoxODIyNjA5OTU0OTM2fQ.qOEf-rDPR5lNTPMdnYtJkZhinB5F6eoUBwSl6eF9WEQ",
  "expiresAt": "2027-10-04T00:32:34.936Z"
}

HTTP 200. Confirm $.preferenceUrl starts with the Nurture public origin and contains /api/public/preferences?token=.

Refused request · root_key_unavailable

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{
  "id": "nct_ac71aaa658214ae0b1aaedbfd5a1dde8"
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.preference_link --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.preference_link --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 503:

{
  "error": {
    "code": "root_key_unavailable",
    "message": "The Nurture application root key is not available, so tokens cannot be signed."
  }
}

HTTP 503. Preserve the refusal details and do not claim success.

Refused request · public_url_unavailable

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{
  "id": "nct_ac71aaa658214ae0b1aaedbfd5a1dde8"
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.preference_link --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.preference_link --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 503:

{
  "error": {
    "code": "public_url_unavailable",
    "message": "NURTURE_PUBLIC_URL is not configured, so no public link can be built."
  }
}

HTTP 503. Preserve the refusal details and do not claim success.

Refused request · not_found

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{
  "id": "nct_none"
}

CLI:

topolo actions validate app_topolo_nurture.subscriptions.preference_link --data @payload.json --json
topolo actions plan app_topolo_nurture.subscriptions.preference_link --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 404:

{
  "error": {
    "code": "not_found",
    "message": "Contact was not found in this workspace."
  }
}

HTTP 404. Preserve the refusal details and do not claim success.

Verify the result

• Confirm $.preferenceUrl starts with the Nurture public origin and contains /api/public/preferences?token=.

Errors and recovery

• organization_required (HTTP 403): Select an organization available to the verified caller before choosing a Nurture workspace.
• permission_denied (HTTP 403): Grant the credential the required Nurture workspace permission.
• workspace_required (HTTP 409): Create a Nurture workspace, or pass the workspace resource context.
• invalid_input (HTTP 422): Correct the fields named in error.details using inputSchema, then retry.
• not_found (HTTP 404): List contacts to find a valid id in this workspace.
• contact_archived (HTTP 409): Archived contacts have no preference centre; use an active contact.
• root_key_unavailable (HTTP 503): Tokens cannot be signed until the application root key is provisioned; check app_topolo_nurture.root_key.status.
• public_url_unavailable (HTTP 503): NURTURE_PUBLIC_URL is not configured for this environment; ask an operator.

Auth or gateway failures may precede this handler. Preserve the exact response shape, error string/code, request id and credential context; no synthetic fixture establishes live credential access.

Recovery boundary

Issuing a link changes no state; it expires on its own after 365 days.

Related actions

• List contact subscriptions: Read a contact's subscription state for every active topic of the workspace: none, pending_confirmation, subscribed or unsubscribed, with since and the evidence that subscribed them. State is resolved by @topolo-io/audience from Nurture's own subscription stream and suppression ledger; an unsubscribe is always a ledger event.

Evidence

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Test scenario and capture digests are retained with each fixture.