Partially updates a personal notification with an application/merge-patch+json body (RFC 7396). Omitted fields stay unchanged; nested objects are deep-merged; nested arrays (for example allocations.ids) are replaced when present. Optional resend fields are cleared with null (for example "settings":{"costAnomalies":{"repeat":null}}). Send null for a settings property to unsubscribe that type. Nulling the last remaining type is 422, decided before the type-permission check, so the status does not depend on which permissions the target user holds. Requires Users Manager (usersManager). For each type still subscribed after the merge, other than costAnomalies, the target user must hold that type's permission, including when the patch does not mention that type (a rename included). The permission id for each type is documented on UserNotificationSettings. A missing permission is 403 with permission and notificationType. A permission lookup that fails is 503. The request also requires the If-Match header and the Idempotency-Key header. With dryRun=true the request goes through the same checks as a real update and returns the notification as it would look after the patch, without changing anything.
Reads are immediately consistent. After a completed update, a GET of that notification returns the new state.