Gmail push notification from Cloud Pub/Sub (public)

POST 
/api/gmail/push

PUBLIC server-to-server endpoint the platform's Cloud Pub/Sub push subscription calls whenever a watched Gmail mailbox changes. NO session / Sanctum / tenant / CSRF — trust comes solely from the OIDC token Pub/Sub signs into the Authorization header: the RS256 signature is checked against Google's published certificates, and the token's aud and email must equal the configured audience and service account.

The body names a mailbox, never a tenant: the address is resolved to every channel listening to it through a platform directory, and one sync job is queued per channel — no Gmail call happens inside the request. A notification older than the channel's stored history cursor queues nothing. 204 for every verified request, including an address nobody routes and a body that cannot be read (redelivery would not change either). 404 while Gmail push is not configured on the platform.

Request

Responses

204

Acknowledged (verified request; a sync may or may not have been queued).

401

The OIDC token is missing or invalid (signature, issuer, audience, service account or expiry). Pub/Sub retries.

404

Gmail push is not configured on this platform.