curl --request GET \
--url https://api.1-funnel.org/v1/businesses/{businessId}/sms/bulk-messages \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.1-funnel.org/v1/businesses/{businessId}/sms/bulk-messages', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.1-funnel.org/v1/businesses/{businessId}/sms/bulk-messages"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)HttpResponse<String> response = Unirest.get("https://api.1-funnel.org/v1/businesses/{businessId}/sms/bulk-messages")
.header("Authorization", "Bearer <token>")
.asString();{
"data": [
{
"id": "018f3c4e-7b2a-7c3d-8e9f-bbbbbbbbbbbb",
"business_id": "018f3c4e-7b2a-7c3d-8e9f-0123456789ab",
"from": "1FUNNEL",
"classification": "promotional",
"status": "completed",
"settled": true,
"message": "Weekend offer",
"template": null,
"accepted_at": "2026-10-13T09:00:00.000Z",
"intake": {
"good": 1000,
"bad": 2,
"empty": 0
},
"submission": {
"processed": 1000,
"success": 980,
"failed": 20,
"retryable_failed_count": 0,
"exhausted": 20
},
"delivery_summary": {
"as_of": "2026-10-13T09:00:00.000Z",
"complete": false,
"outcomes_resolved": 850
},
"warnings": []
}
],
"pagination": {
"limit": 50,
"has_more": false,
"next_cursor": null
}
}List bulk SMS messages
Cursor-paginated bulk messages (DEC-SMS-F01 / C01). Default ordering:
creation timestamp descending with stable id tie-breaker. Inclusive
created_from, exclusive created_to; max range 90 days.
curl --request GET \
--url https://api.1-funnel.org/v1/businesses/{businessId}/sms/bulk-messages \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.1-funnel.org/v1/businesses/{businessId}/sms/bulk-messages', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.1-funnel.org/v1/businesses/{businessId}/sms/bulk-messages"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)HttpResponse<String> response = Unirest.get("https://api.1-funnel.org/v1/businesses/{businessId}/sms/bulk-messages")
.header("Authorization", "Bearer <token>")
.asString();{
"data": [
{
"id": "018f3c4e-7b2a-7c3d-8e9f-bbbbbbbbbbbb",
"business_id": "018f3c4e-7b2a-7c3d-8e9f-0123456789ab",
"from": "1FUNNEL",
"classification": "promotional",
"status": "completed",
"settled": true,
"message": "Weekend offer",
"template": null,
"accepted_at": "2026-10-13T09:00:00.000Z",
"intake": {
"good": 1000,
"bad": 2,
"empty": 0
},
"submission": {
"processed": 1000,
"success": 980,
"failed": 20,
"retryable_failed_count": 0,
"exhausted": 20
},
"delivery_summary": {
"as_of": "2026-10-13T09:00:00.000Z",
"complete": false,
"outcomes_resolved": 850
},
"warnings": []
}
],
"pagination": {
"limit": 50,
"has_more": false,
"next_cursor": null
}
}Authorizations
OAuth 2.0 Client Credentials for the External Integration API (ADR-015, ADR-023).
Client authentication: HTTP Basic (client_secret_basic).
Access-token audience: 1funnel-external-api.
The tokenUrl below is the production target. Sandbox uses a different
host. OpenAPI cannot bind tokenUrl to the selected servers entry; see
x-1funnel-oauth on the root document and the authentication guide when published.
Coarse OAuth scopes (if any) are token-level vocabulary (ADR-013 IA-06). They
are not the ADR-022 resource permission catalogue. Resource permissions
are enforced after token validation via application-to-business grants
(ADR-016) and are documented per operation with x-required-permissions.
These URLs are architecture targets. They are not claimed to be deployed or generally available.
Headers
Request correlation identifier (STD-API-01 D12). Clients may supply a value
of 1–128 characters matching A-Za-z0-9._-. Missing or invalid values are
replaced by a server-generated identifier. Distinct from W3C traceparent,
resource ids, Idempotency-Key, and webhook event ids.
1 - 128^[A-Za-z0-9._-]+$"req_01HZX3K9EXAMPLE"
Path Parameters
Business resource selector in /v1/businesses/{businessId}/… (ADR-006).
UUIDv7-compatible opaque identifier. {businessId} is not authorization
proof. The resource server must independently verify an active
application-to-business grant, required permission, and ownership (ADR-016,
ADR-022).
UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new
platform-generated external resource identifiers. Clients must still treat
the value as opaque. Not every path parameter is guaranteed to be v7 solely
because it is a UUID; use this schema where the contract asserts UUIDv7.
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"
Query Parameters
Maximum items to return for SMS collection endpoints only (DEC-SMS-F01).
Default 100. Maximum 1000. Values above the maximum are rejected with
400 / validation_failed.
Explicit SMS-specific exception
STD-API-01 D05 retains default 50 / maximum 200 on the shared Limit
parameter. The SMS defaults 100 / 1000 are an explicitly approved
SMS-only exception. Do not apply SmsLimit to wallet, OTP, webhook, or
other non-SMS collections. Do not change shared Limit or STD-API-01 here.
1 <= x <= 1000100
Opaque pagination cursor (DEC-SMS-C01). Lifetime is 24 hours. Bound to
business, resource, filters, and default ordering. Clients must not parse
the cursor. Expired or invalid cursors return 400 / validation_failed.
Cursor lifetime does not imply snapshot isolation of mutable delivery
outcomes.
1"eyJvZmZzZXQiOiJleGFtcGxlIn0"
Bulk-message processing lifecycle (ADR-018 SMS-13 / ADR-003 Model B).
completed means the primary processing pass finished — not all delivered
and not all retries settled.
created, scheduled, queued, processing, paused, completed, failed, cancelled "processing"
Public message classification (lowercase snake_case). Transactional vs promotional distinction for compliance and routing policy.
transactional, promotional "transactional"
Authorized sender identity for the business (from). The backend validates
that the application/business may use this sender. Arbitrary sender IDs are
not permitted. Public sender-ID management resources remain future
(ADR-018 SMS-19 / target architecture).
1 - 20"1FUNNEL"
Inclusive lower bound on creation timestamp.
RFC 3339 date-time. Response timestamps are UTC with a Z offset
(STD-API-01 D06). Client-supplied timestamps must include an explicit offset;
local times without an offset are rejected.
"2026-10-13T09:00:00.000Z"
Exclusive upper bound on creation timestamp.
RFC 3339 date-time. Response timestamps are UTC with a Z offset
(STD-API-01 D06). Client-supplied timestamps must include an explicit offset;
local times without an offset are rejected.
"2026-10-13T09:00:00.000Z"
Response
Bulk message page