Sets who hears about this tenant's protected domains, and about what: the recipient list and the severities worth an email. Stored as one attribute on the tenant's settings and read by the notifier, which is the single send path.

Either field may be omitted, in which case its current value is kept; at least one must be present. Send an EMPTY array to clear a field. Empty recipients means nobody is mailed - there is NO fallback to the tenant's administrators (for a partner-managed tenant that would mail the partner instead of the customer). Empty severities turns notifications off. There is no enabled on the wire: it is derived - any severity on means enabled - so a client cannot post a flag that disagrees with the list.

Recipients may be ANY address; there is no domain restriction, so a distribution list or an external MSSP mailbox is fine. Up to 10. A save that would silently mail nobody - severities on with no recipients - is refused rather than accepted. Digests start once the notifier is armed, and their branding follows the tenant's white-label settings.

The change is audited under the API caller's email (X-Email-Address): this write is how somebody stops hearing about their own domain being spoofed. The response is the settings as re-read after the write, in the shape get-notification-settings returns - normalised and de-duplicated, not an echo of the request.

Requires an Enterprise subscription (ErrorCode ENTERPRISE_REQUIRED; not satisfied by Professional, and get-entitlements.isEnterpriseEntitled does not imply it for partner-managed or staff-trial tenants). Platform Admin or Super Admin and a paid plan.