# Route Spec

## Route ID
`notifications-device-token-delete`

## Endpoint
`DELETE /api/v1/notifications/device-tokens`

## Human Description
Removes one Firebase Cloud Messaging token from the current signed-in user's account. The mobile client calls this before logout/account switching when possible. The operation is current-user scoped and idempotent.

## Authentication
- Required: `yes`

## Request
### Headers
- `Content-Type: application/json`

### Body
```json
{"token": "fcm-registration-token"}
```

### Validation Rules
- `token`: required, 16-4096 characters, with no whitespace or control characters.
- A token belonging to another user is not removed.

## Responses
### Success: `200 OK`
```json
{"success": true, "message": "Notification device removed", "data": {"removed": true}}
```

`removed` is `false` when no matching current-user registration existed.

### Error: `401 Unauthorized`
```json
{"success": false, "error": {"code": "UNAUTHORIZED", "message": "Authentication required.", "details": {}}}
```

### Error: `422 Unprocessable Entity`
```json
{"success": false, "error": {"code": "VALIDATION_FAILED", "message": "Please fix highlighted fields.", "details": {}}}
```

## Idempotency and Retries
- Idempotent: `yes`.

## Data & Caching Dependencies
- **Spanner Tables:** `notification_device_tokens (Read/Write)`

## Side Effects
- Deletes only the matching current-user token registration.
- Mobile logout also supplies the same token to `/auth/logout` as redundant server cleanup and invalidates it with Firebase; logout-all/account deletion remove every owned token.