Comment by rickmode

Naive question: why not remove all sensitive data, or all data, from the notification and leave the context for a secondary API call?