isNode marker, either as the ?isNode query flag or as an isNode body field. Any other caller receives a 403, so an ordinary authenticated client cannot forge a notification through this path. It exists for the delivery node to forward the one event the API cannot observe directly. The write is idempotent on the natural key dedupe_key. The row is written through nsCreate() and replicates to every server over the event bus; the 202 means the event was published and is applied on each server when the event returns. The category notice is rejected here, because notices are a separate flow.curl --location '/notifications' \
--header 'Content-Type: application/json' \
--data '{
"isNode": true,
"category": "voicemail",
"scope": "user",
"domain": "example.com",
"user": "1001",
"source_type": "vmail_forward",
"source_id": "vm-2026-0901-0007",
"severity": "info",
"title": "New voicemail",
"body": "Duration 0:42.",
"payload": {
"callid": "20260901143000-abc123",
"duration": 42
},
"expires_at": "2026-09-08 14:30:00"
}'{
"code": 202,
"message": "Accepted"
}