### Author:  [@duranmla](https://meta.discourse.org/u/duranmla)
#### Post date: [April 4, 2019, 7:13am UTC](https://meta.discourse.org/t/mark-notifications-as-read-from-discourse-api/113420/1 "2019-04-04T07:13:31Z")
Hi all,
I am working in a project that has discourse integrated with several apps, by now, I need to be able to allow one of those external apps to mark notifications from discourse as read but of course, consuming the API.
For instance, if I try to hit the `notifications/mark-read` endpoint I will get
Nevertheless, I will stress that I have already manage basic things as CORS config and token handling from outside (For instance my component is able to login/logout the user and pull user notifications).
The idea is that this custom component has a button to “Mark all as read”
I have also seen this “clear\_notifications” method
>
And it while it looks like the thing I can use it seems to not be exposed or available for the usage outside discourse app?
Thanks in advance for any help.
Cheers!!
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [April 4, 2019, 7:49pm UTC](https://meta.discourse.org/t/mark-notifications-as-read-from-discourse-api/113420/2 "2019-04-04T19:49:47Z")
You should mark notifications as read from the backend, not from the frontend.
---
### Author:  [@duranmla](https://meta.discourse.org/u/duranmla)
#### Post date: [April 5, 2019, 8:09am UTC](https://meta.discourse.org/t/mark-notifications-as-read-from-discourse-api/113420/3 "2019-04-05T08:09:16Z")
Thanks for the answer, nevertheless, just to double check: It means there is no built-in endpoint that I can use from outside front-end in order to mark the notifications as read?
I should add that functionality myself on the backend and then consume that new endpoint to mark notifications as read. It is like that?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 5, 2019, 10:57am UTC](https://meta.discourse.org/t/mark-notifications-as-read-from-discourse-api/113420/4 "2019-04-05T10:57:00Z")
Anything you can do from the website you can do from the API per:
> [@Reverse engineer the Discourse API](https://meta.discourse.org/t/how-to-reverse-engineer-the-discourse-api/20576):
>
> Discourse is backed by a complete JSON api. Anything you can do on the site you can also do using the JSON api. The API is documented at [docs.discourse.org](https://docs.discourse.org). You can also use the [discourse\_api](https://github.com/discourse/discourse_api) Ruby gem as a client library. However, not every endpoint is documented. To determine how to do something with the JSON API here are some steps you can follow. Example: recategorize a topic. Go to a topic and start editing a category: Open Chrome dev tools, switch to the Network tab, select …
The problem here is that delegating this to clients is inherently unsafe. How do you have confidence the end users are even logged in to Discourse?
---
### Author:  [@duranmla](https://meta.discourse.org/u/duranmla)
#### Post date: [April 6, 2019, 5:36pm UTC](https://meta.discourse.org/t/mark-notifications-as-read-from-discourse-api/113420/5 "2019-04-06T17:36:43Z")
In my very specific case the problem was related to the fact that I had one plugin in place that rewrite the `class Discourse::Cors` method `def self.apply_headers(cors_origins, env, headers)`, thus, I didn’t have the behaviour of the Discourse source code defined at [discourse/config/initializers/008-rack-cors.rb at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/master/config/initializers/008-rack-cors.rb#L44) but instead some custom thing that I don’t even need.
Once I remove the plugin I get back the core definition for CORS and everything works as expected.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [February 27, 2020, 9:46am UTC](https://meta.discourse.org/t/mark-notifications-as-read-from-discourse-api/113420/6 "2020-02-27T09:46:03Z")