Pushello API reference

Every endpoint of the Pushello REST API, generated from the API itself.

All endpoints are relative to https://api.pushello.com. Create an API key in your Pushello dashboard, then authenticate every request with it.

apiKey — HTTP Basic auth carrying only the API key secret: Authorization: Basic base64(<key secret>).

accessToken — Operator session token issued by the Pushello dashboard: Authorization: Token <access token>.

Download the OpenAPI specification for use with your own tooling.

Devices

GET/api/devices

List registered devices

Lists the devices registered in your organization. Requires the devices:read scope.

devices:readapiKeyaccessToken
Parameters
NameInTypeDescription
projectIdquerystring
platformquerystring (APN | FCM | WebPush | WNS)
limitqueryinteger
skipqueryinteger
Responses
StatusMeaning
200Array of devices
401Missing or invalid credentials
403API key is missing the devices:read scope
429API key rate limit exceeded
defaultRequest failed
POST/api/projects/{projectId}/devices

Register a device

Registers a device token so it can receive push notifications. Called by the client SDKs; no API key is required.

Parameters
NameInTypeDescription
projectIdrequiredpathstring
Request body
FieldTypeDescription
tokenrequiredstring
platformrequiredstring (APN | FCM | WebPush | WNS)
environmentstring (sandbox | production)
metadataobject
previousTokenstring
wnsAuthenticationModestring (legacy | entra)Required as entra for Windows App SDK channels. Omitted historical WNS registrations default to Partner Center legacy; invalid on other platforms.
Responses
StatusMeaning
200The registered device id
404Project not found
defaultRequest failed

Notifications

GET/api/notifications

List published notifications

Lists the notifications published in your organization, newest first. Requires the notifications:read scope.

notifications:readapiKeyaccessToken
Parameters
NameInTypeDescription
projectIdquerystring
limitqueryinteger
skipqueryinteger
sortDirectionquerystring (ASC | DESC)
Responses
StatusMeaning
200Array of notifications
401Missing or invalid credentials
403API key is missing the notifications:read scope
429API key rate limit exceeded
defaultRequest failed
POST/api/projects/{projectId}/notifications/publish

Publish a notification to interests or users

Fans a push notification out to every device subscribed to the given interests, or associated with the given user ids. verifiedUsers targets only cryptographically verified device-user bindings. Authenticate with a marketplace API key (Basic auth) carrying the notifications:write scope, or with the project's legacy publish token (Bearer auth). Bearer publishes that include users or verifiedUsers require the private project secret; the legacy project key remains valid only for interest broadcasts on projects that have not disabled that legacy credential. DodoDentist has disabled it and requires its private project secret for every Bearer publish, including interest broadcasts.

notifications:writeapiKey
Parameters
NameInTypeDescription
projectIdrequiredpathstring
Request body
FieldTypeDescription
interestsarray
usersarray
verifiedUsersarray
apnsobject
fcmobject
webpushobject
wnsobject
Responses
StatusMeaning
200The publish id and target/attempt/outcome counts
401Missing or invalid credentials
403API key is missing the notifications:write scope
404Project not found
429API key rate limit exceeded
defaultRequest failed

Projects

GET/api/projects

List projects

Lists the projects in your organization (push provider credentials stripped). Requires the projects:read scope.

projects:readapiKeyaccessToken
Responses
StatusMeaning
200Array of projects
401Missing or invalid credentials
403API key is missing the projects:read scope
429API key rate limit exceeded
defaultRequest failed

Webhook subscriptions

GET/api/webhooksubscriptions

List webhook subscriptions

Webhook subscriptions deliver notification.published, device.created and device.deleted events to your server as signed POST requests (X-Pushello-Signature: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body">). An endpoint failing 20 times in a row is disabled automatically. Subscriptions are managed with an operator access token; the secret is only returned once, on create.

accessToken
Responses
StatusMeaning
200Array of webhook subscriptions (without secrets)
defaultRequest failed
POST/api/webhooksubscriptions

Create a webhook subscription

The response includes the signing secret exactly once — store it; it cannot be retrieved again.

accessToken
Request body
FieldTypeDescription
projectIdrequiredstring
urlrequiredstring
eventsarray (notification.published | device.created | device.deleted)Empty array subscribes to all events
Responses
StatusMeaning
200The created subscription, including its secret
defaultRequest failed
PUT/api/webhooksubscriptions/{webhookSubscriptionId}

Update a webhook subscription

url, events and active are editable; the secret and project are immutable. Re-enabling an auto-disabled endpoint is done by setting active back to true.

accessToken
Parameters
NameInTypeDescription
webhookSubscriptionIdrequiredpathstring
Responses
StatusMeaning
200The updated subscription (without secret)
defaultRequest failed
DELETE/api/webhooksubscriptions/{webhookSubscriptionId}

Delete a webhook subscription

Delete a webhook subscription

accessToken
Parameters
NameInTypeDescription
webhookSubscriptionIdrequiredpathstring
Responses
StatusMeaning
200Deleted
defaultRequest failed