> ## Documentation Index > Fetch the complete documentation index at: https://documentation.suby.fi/llms.txt > Use this file to discover all available pages before exploring further. # Update notification preferences > Send the whole `preferences` object — it replaces the stored value. Pass `null` to reset to the product defaults. **Merchant-of-Record organizations** cannot disable `customerEmails.receipt`: Suby is the legal seller and issues the receipt. Sending `{"enabled": false}` returns `403 CUSTOMER_EMAIL_LOCKED_MOR`. Check `merchantOfRecord` on the response to know whether the lock applies. ## OpenAPI ````yaml /v3-beta/api-reference/openapi.yaml patch /v3/notification-preferences openapi: 3.1.0 info: title: Suby.fi Merchant API version: 3.0.0-beta description: > The **v3** public merchant API for Suby.fi. RESTful (plural, resource-oriented endpoints under the `/v3` prefix). Authenticate every request with your secret API key in the `X-Suby-Api-Key` header. - `sk_live_…` keys operate in **production** (real funds). - `sk_sandbox_…` keys operate in a fully simulated **sandbox** (test cards, Base Sepolia crypto, no real money). The environment is derived from the key prefix. All monetary amounts are **integer cents** (except `priceCents` on some read shapes, which is a string) — token amounts are strings in the smallest unit (sats / lamports / wei). Fees are basis points. contact: email: dev@suby.fi url: https://suby.fi servers: - url: https://api.beta.suby.fi description: Production + sandbox (environment selected by API key prefix) security: - ApiKeyAuth: [] tags: - name: Products description: Manage your product catalog (one-time and recurring). - name: Checkout description: >- Hosted checkout — signed session tokens (`cs_…`) plus branding and appearance settings. - name: Payments description: >- Create, capture, void, and retrieve one-time & off-session payments (card, APM, and crypto). - name: Subscriptions description: Start and cancel recurring subscriptions. - name: Customers description: First-class customer records with billing address. - name: Payment Methods description: >- Save a payment method to a customer and manage saved instruments for off-session charges. - name: Webhook Endpoints description: Register outbound webhook destinations and rotate signing secrets. - name: Notifications description: Per-org email notification preferences — team alerts and customer emails. - name: Analytics description: Org-wide revenue analytics. - name: Health description: Unauthenticated liveness probe. paths: /v3/notification-preferences: patch: tags: - Notifications summary: Update notification preferences description: > Send the whole `preferences` object — it replaces the stored value. Pass `null` to reset to the product defaults. **Merchant-of-Record organizations** cannot disable `customerEmails.receipt`: Suby is the legal seller and issues the receipt. Sending `{"enabled": false}` returns `403 CUSTOMER_EMAIL_LOCKED_MOR`. Check `merchantOfRecord` on the response to know whether the lock applies. operationId: updateNotificationPreferences requestBody: required: true content: application/json: schema: type: object properties: preferences: nullable: true allOf: - $ref: '#/components/schemas/NotificationPreferencesValue' description: '`null` resets to the product defaults.' responses: '200': description: Preferences updated content: application/json: schema: allOf: - $ref: '#/components/schemas/SuccessEnvelope' - properties: data: $ref: '#/components/schemas/NotificationPreferences' '401': $ref: '#/components/responses/Unauthorized' '403': description: >- `CUSTOMER_EMAIL_LOCKED_MOR` — a merchant-of-record org cannot disable the customer receipt. content: application/json: schema: $ref: '#/components/schemas/Error' '422': $ref: '#/components/responses/ValidationError' components: schemas: NotificationPreferencesValue: type: object description: | Which emails Suby sends. Unknown keys are rejected (422). Team alerts go to the teammate emails you list; customer emails go to the buyer. properties: teamAlerts: type: object description: >- Operational alerts, one entry per event. Every alert defaults to off. additionalProperties: false properties: newPayment: $ref: '#/components/schemas/TeamAlertChannel' payoutReceived: $ref: '#/components/schemas/TeamAlertChannel' chargeback: $ref: '#/components/schemas/TeamAlertChannel' disputeDeadline: $ref: '#/components/schemas/TeamAlertChannel' disputeOutcome: $ref: '#/components/schemas/TeamAlertChannel' subscriptionCanceled: $ref: '#/components/schemas/TeamAlertChannel' customerEmails: type: object description: Transactional emails sent to the buyer. No recipient choice. additionalProperties: false properties: receipt: type: object additionalProperties: false properties: enabled: type: boolean description: Defaults to `true`. Locked on for merchant-of-record orgs. SuccessEnvelope: type: object required: - success - data properties: success: type: boolean example: true message: type: string data: description: Endpoint-specific payload. NotificationPreferences: type: object properties: organizationId: type: string preferences: $ref: '#/components/schemas/NotificationPreferencesValue' merchantOfRecord: type: boolean description: > True when Suby is the merchant of record for this organization. The customer receipt is then locked on — `customerEmails.receipt.enabled` always reads `true` and cannot be set to `false`. updatedAt: type: string format: date-time Error: type: object required: - success - error properties: success: type: boolean example: false error: type: string description: Machine-readable error code. example: NOT_FOUND message: type: string example: Resource not found data: description: Optional error detail. TeamAlertChannel: type: object additionalProperties: false properties: enabled: type: boolean recipients: type: array maxItems: 50 items: type: string format: email description: >- Teammate emails on this organization. Empty = the alert reaches nobody. ValidationErrorEnvelope: allOf: - $ref: '#/components/schemas/Error' - type: object properties: data: type: object properties: fieldErrors: type: array items: type: object properties: field: type: string message: type: string responses: Unauthorized: description: Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/Error' example: success: false error: UNAUTHORIZED message: Invalid or missing API key ValidationError: description: Request failed schema validation content: application/json: schema: $ref: '#/components/schemas/ValidationErrorEnvelope' example: success: false error: VALIDATION_ERROR message: Validation failed data: fieldErrors: - field: method message: method is a required field securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-Suby-Api-Key description: Secret API key. `sk_live_…` (production) or `sk_sandbox_…` (sandbox). ````