Read notification templates

get/api/notification-templates

The only GET among the session-authenticated routes; everything else the dashboard reads comes through server components, not the API. Returns the stock templates alongside the org's overrides so the editor can show both and offer "revert to default" without a second source of truth on the client.

Authorization

sessionCookie

sb-qxrvgfkjyvbngipqvslu-auth-token<token>

The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.

Every request re-validates it against the Auth server (getUser()), never by decoding the cookie locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified app_metadata.company_id claim and enforced by row-level security; it is never read from request input, on any route, ever.

role (admin / staff) is deliberately not in RLS. It gates specific actions in route code, the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's own check is the enforcement.

In: cookie

Response Body

`application/json`

curl -X GET "https://example.com/api/notification-templates"

{  "defaults": [    {}  ],  "overrides": [    {      "type": "confirmation",      "channel": "email",      "subject": "string",      "body": "string",      "updated_at": "2019-08-24T14:15:22Z"    }  ],  "variables": [    {}  ],  "canCustomize": true,  "canEdit": true}

AuthorizationCopy Anchor Link

Response BodyCopy Anchor Link

200application/json

401application/json

403application/json

Authorization

Response Body

`application/json`

`application/json`

`application/json`