Skip to main content

Authorizations

​
Authorization
string
header
required

OAuth 2.0 Client Credentials for the External Integration API (ADR-015, ADR-023).

Client authentication: HTTP Basic (client_secret_basic). Access-token audience: 1funnel-external-api.

The tokenUrl below is the production target. Sandbox uses a different host. OpenAPI cannot bind tokenUrl to the selected servers entry; see x-1funnel-oauth on the root document and the authentication guide when published.

Coarse OAuth scopes (if any) are token-level vocabulary (ADR-013 IA-06). They are not the ADR-022 resource permission catalogue. Resource permissions are enforced after token validation via application-to-business grants (ADR-016) and are documented per operation with x-required-permissions.

These URLs are architecture targets. They are not claimed to be deployed or generally available.

Headers

​
X-Request-Id
string

Request correlation identifier (STD-API-01 D12). Clients may supply a value of 1–128 characters matching A-Za-z0-9._-. Missing or invalid values are replaced by a server-generated identifier. Distinct from W3C traceparent, resource ids, Idempotency-Key, and webhook event ids.

Required string length: 1 - 128
Pattern: ^[A-Za-z0-9._-]+$
Example:

"req_01HZX3K9EXAMPLE"

Path Parameters

​
businessId
string<uuid>
required

Business resource selector in /v1/businesses/{businessId}/… (ADR-006). UUIDv7-compatible opaque identifier. {businessId} is not authorization proof. The resource server must independently verify an active application-to-business grant, required permission, and ownership (ADR-016, ADR-022).

UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new platform-generated external resource identifiers. Clients must still treat the value as opaque. Not every path parameter is guaranteed to be v7 solely because it is a UUID; use this schema where the contract asserts UUIDv7.

Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
Example:

"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"

​
templateId
string<uuid>
required

SMS template identifier (UUIDv7). Not authorization proof. UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new platform-generated external resource identifiers. Clients must still treat the value as opaque. Not every path parameter is guaranteed to be v7 solely because it is a UUID; use this schema where the contract asserts UUIDv7.

Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
Example:

"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"

Body

application/json

Update template metadata or content. Content changes create a new immutable revision; prior revision IDs remain valid for historical sends (ADR-018 SMS-08). Lifecycle transitions use status (including archived for soft-delete).

​
name
string
Required string length: 1 - 128
​
message
string
Required string length: 1 - 4096
​
variable_keys
string[]
Required string length: 1 - 64
Pattern: ^[a-z][a-z0-9_]*$
​
status
enum<string>

Public SMS template lifecycle (ADR-018 SMS-08). Lowercase snake_case.

Available options:
draft,
active,
suspended,
archived
Example:

"active"

Response

Template updated

SMS template with current revision pointer. Historical sends pin current_revision_id (or an older revision) immutably.

​
id
string<uuid>
required

UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new platform-generated external resource identifiers. Clients must still treat the value as opaque. Not every path parameter is guaranteed to be v7 solely because it is a UUID; use this schema where the contract asserts UUIDv7.

Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
Example:

"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"

​
business_id
string<uuid>
required

UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new platform-generated external resource identifiers. Clients must still treat the value as opaque. Not every path parameter is guaranteed to be v7 solely because it is a UUID; use this schema where the contract asserts UUIDv7.

Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
Example:

"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"

​
name
string
required
​
status
enum<string>
required

Public SMS template lifecycle (ADR-018 SMS-08). Lowercase snake_case.

Available options:
draft,
active,
suspended,
archived
Example:

"active"

​
message
string
required

Message content of the current revision.

​
current_revision_id
string<uuid>
required

UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new platform-generated external resource identifiers. Clients must still treat the value as opaque. Not every path parameter is guaranteed to be v7 solely because it is a UUID; use this schema where the contract asserts UUIDv7.

Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
Example:

"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"

​
created_at
string<date-time>
required

RFC 3339 date-time. Response timestamps are UTC with a Z offset (STD-API-01 D06). Client-supplied timestamps must include an explicit offset; local times without an offset are rejected.

Example:

"2026-10-13T09:00:00.000Z"

​
updated_at
string<date-time>
required

RFC 3339 date-time. Response timestamps are UTC with a Z offset (STD-API-01 D06). Client-supplied timestamps must include an explicit offset; local times without an offset are rejected.

Example:

"2026-10-13T09:00:00.000Z"

​
variable_keys
string[]