Document undocumented API endpoints (#2805)

* Document avatar removal API endpoint

* Document notification settings API endpoints

* Document access token list and delete API endpoints

* Document join code API endpoints

* Fix access token delete URL parameter name in docs

docs/api/sections/account.md

@@ -18,6 +18,54 @@ __Response:__
 
 The `auto_postpone_period_in_days` is the account-level default in days (e.g. `30`). Cards are automatically moved to "Not Now" after this period of inactivity. Each board can override this with its own value.
 
+## `GET /account/join_code`
+
+Returns the account's join code for inviting new users. The join code URL can be shared with people to let them join the account.
+
+__Response:__
+
+```json
+{
+  "code": "abc123",
+  "usage_count": 3,
+  "usage_limit": 10,
+  "url": "http://fizzy.localhost:3006/897362094/join/abc123",
+  "active": true
+}
+```
+
+A join code is `active` when `usage_count` is less than `usage_limit`.
+
+## `PUT /account/join_code`
+
+Updates the join code's usage limit. Requires admin role.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `usage_limit` | integer | Yes | Maximum number of times the join code can be used |
+
+__Request:__
+
+```json
+{
+  "account_join_code": {
+    "usage_limit": 10
+  }
+}
+```
+
+__Response:__
+
+Returns `204 No Content` on success.
+
+## `DELETE /account/join_code`
+
+Resets the join code, generating a new one and invalidating the old code. Requires admin role.
+
+__Response:__
+
+Returns `204 No Content` on success.
+
 ## `PUT /account/entropy`
 
 Updates the account-level default auto close period. Requires admin role.

docs/api/sections/authentication.md

@@ -170,3 +170,41 @@ HTTP/1.1 201 Created
 ```
 
 Store the `token` value securely — it won't be retrievable again. Use it as a Bearer token for subsequent API requests.
+
+### List access tokens
+
+Returns all access tokens for the authenticated identity.
+
+```bash
+curl -H "Authorization: Bearer put-your-access-token-here" \
+  -H "Accept: application/json" \
+  https://app.fizzy.do/my/access_tokens
+```
+
+__Response:__
+
+```json
+[
+  {
+    "id": "03f5v9zo9qlcwwpyc0ascnikz",
+    "description": "Fizzy CLI",
+    "permission": "write",
+    "created_at": "2025-12-05T19:36:35.534Z"
+  }
+]
+```
+
+Note: The raw token value is only returned once at creation time and cannot be retrieved again.
+
+### Delete an access token
+
+```bash
+curl -X DELETE \
+  -H "Authorization: Bearer put-your-access-token-here" \
+  -H "Accept: application/json" \
+  https://app.fizzy.do/my/access_tokens/:id
+```
+
+__Response:__
+
+Returns `204 No Content` on success.

docs/api/sections/notifications.md

@@ -60,3 +60,39 @@ Marks all unread notifications as read.
 __Response:__
 
 Returns `204 No Content` on success.
+
+## `GET /:account_slug/notifications/settings`
+
+Returns the current user's notification settings.
+
+__Response:__
+
+```json
+{
+  "bundle_email_frequency": "every_few_hours"
+}
+```
+
+Possible values for `bundle_email_frequency`: `never`, `every_few_hours`, `daily`, `weekly`.
+
+## `PUT /:account_slug/notifications/settings`
+
+Updates the current user's notification settings.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `bundle_email_frequency` | string | Yes | How often to bundle notification emails. One of: `never`, `every_few_hours`, `daily`, `weekly` |
+
+__Request:__
+
+```json
+{
+  "user_settings": {
+    "bundle_email_frequency": "daily"
+  }
+}
+```
+
+__Response:__
+
+Returns `204 No Content` on success.

docs/api/sections/users.md

@@ -90,6 +90,14 @@ __Response:__
 
 Returns `204 No Content` on success.
 
+## `DELETE /:account_slug/users/:user_id/avatar`
+
+Removes the user's avatar image. You can only remove avatars for users you have permission to change.
+
+__Response:__
+
+Returns `204 No Content` on success.
+
 ## `DELETE /:account_slug/users/:user_id`
 
 Deactivates a user. You can only deactivate users you have permission to change.