# Sprint 22 API Reference

## Notifications

```text
GET  /api/notifications
GET  /api/notifications/summary
GET  /api/notifications/preferences
POST /api/notifications/preferences
POST /api/notifications/read
POST /api/notifications/archive
POST /api/notifications/create
POST /api/notifications/report
POST /api/notifications/document
POST /api/notifications/approval
```

## Collaboration

```text
GET  /api/collaboration/conversations
GET  /api/collaboration/messages
POST /api/collaboration/conversations
POST /api/collaboration/participants
POST /api/collaboration/messages
POST /api/collaboration/attachments
```

Attachments link a message to an existing BCOS `files` record. The file must have malware-scan status `CLEAN`.

## Email administration

```text
GET  /api/email/templates
GET  /api/email/configs
GET  /api/email/queue
POST /api/email/configs
POST /api/email/configs/test
POST /api/email/queue
POST /api/email/queue/process
```

SMTP password ciphertext is never included in read responses.

## Reminders and scheduler

```text
GET  /api/reminders
POST /api/reminders
POST /api/scheduler/run
```

All routes except read-only personal notification operations require explicit administrative or collaboration permissions. Every POST route uses CSRF validation.