Skip to content

The Web Push application server key

GET
/v1/push/application-server-key
curl --request GET \
--url https://api.aerandil.com/v1/push/application-server-key \
--header 'Authorization: Bearer <token>'

The deployment’s VAPID public key (RFC 8292), which a handset passes as applicationServerKey to pushManager.subscribe() before registering the resulting subscription. 404 push_not_configured when the deployment sends no push notifications (AERANDIL_PUSH_ENABLED unset) — the handset’s cue to offer nothing.

The key.

Media typeapplication/json
object
application_server_key
required

The deployment’s VAPID public key (65-byte uncompressed P-256 point, base64url). Decode it and pass it as applicationServerKey to pushManager.subscribe().

string
Examplegenerated
{
"application_server_key": "example"
}
Cache-Control
string

Always no-store.

No such object in the caller’s tenant — which is also the answer when it exists in another tenant, by design.

Media typeapplication/json

Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.

object
error
required
object
code
required

Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).

string
instance_id

Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.

string
message
required

Human-readable explanation of the failure.

string
parameters

Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).

Examplegenerated
{
"error": {
"code": "example",
"instance_id": "example",
"message": "example",
"parameters": "example"
}
}