curl --request GET \
--url https://api.1-funnel.org/v1/businesses/{businessId}/webhook-endpoints/{endpointId}/deliveries/{deliveryId} \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.1-funnel.org/v1/businesses/{businessId}/webhook-endpoints/{endpointId}/deliveries/{deliveryId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.1-funnel.org/v1/businesses/{businessId}/webhook-endpoints/{endpointId}/deliveries/{deliveryId}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)HttpResponse<String> response = Unirest.get("https://api.1-funnel.org/v1/businesses/{businessId}/webhook-endpoints/{endpointId}/deliveries/{deliveryId}")
.header("Authorization", "Bearer <token>")
.asString();{
"id": "018f3c4e-7b2a-7c3d-8e9f-111111111111",
"event_id": "018f3c4e-7b2a-7c3d-8e9f-ffffffffffff",
"endpoint_id": "018f3c4e-7b2a-7c3d-8e9f-eeeeeeeeeeee",
"status": "succeeded",
"attempt_count": 1,
"last_http_status": 200,
"last_attempted_at": "2026-10-13T09:00:06.000Z",
"next_retry_at": null,
"status_reason": null,
"created_at": "2026-10-13T09:00:05.000Z"
}Retrieve a delivery record
Single delivery inspection record. Safe diagnostics only — no secrets or internal infrastructure details.
curl --request GET \
--url https://api.1-funnel.org/v1/businesses/{businessId}/webhook-endpoints/{endpointId}/deliveries/{deliveryId} \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.1-funnel.org/v1/businesses/{businessId}/webhook-endpoints/{endpointId}/deliveries/{deliveryId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.1-funnel.org/v1/businesses/{businessId}/webhook-endpoints/{endpointId}/deliveries/{deliveryId}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)HttpResponse<String> response = Unirest.get("https://api.1-funnel.org/v1/businesses/{businessId}/webhook-endpoints/{endpointId}/deliveries/{deliveryId}")
.header("Authorization", "Bearer <token>")
.asString();{
"id": "018f3c4e-7b2a-7c3d-8e9f-111111111111",
"event_id": "018f3c4e-7b2a-7c3d-8e9f-ffffffffffff",
"endpoint_id": "018f3c4e-7b2a-7c3d-8e9f-eeeeeeeeeeee",
"status": "succeeded",
"attempt_count": 1,
"last_http_status": 200,
"last_attempted_at": "2026-10-13T09:00:06.000Z",
"next_retry_at": null,
"status_reason": null,
"created_at": "2026-10-13T09:00:05.000Z"
}Authorizations
OAuth 2.0 Client Credentials for the External Integration API (ADR-015, ADR-023).
Client authentication: HTTP Basic (client_secret_basic).
Access-token audience: 1funnel-external-api.
The tokenUrl below is the production target. Sandbox uses a different
host. OpenAPI cannot bind tokenUrl to the selected servers entry; see
x-1funnel-oauth on the root document and the authentication guide when published.
Coarse OAuth scopes (if any) are token-level vocabulary (ADR-013 IA-06). They
are not the ADR-022 resource permission catalogue. Resource permissions
are enforced after token validation via application-to-business grants
(ADR-016) and are documented per operation with x-required-permissions.
These URLs are architecture targets. They are not claimed to be deployed or generally available.
Headers
Request correlation identifier (STD-API-01 D12). Clients may supply a value
of 1–128 characters matching A-Za-z0-9._-. Missing or invalid values are
replaced by a server-generated identifier. Distinct from W3C traceparent,
resource ids, Idempotency-Key, and webhook event ids.
1 - 128^[A-Za-z0-9._-]+$"req_01HZX3K9EXAMPLE"
Path Parameters
Business resource selector in /v1/businesses/{businessId}/… (ADR-006).
UUIDv7-compatible opaque identifier. {businessId} is not authorization
proof. The resource server must independently verify an active
application-to-business grant, required permission, and ownership (ADR-016,
ADR-022).
UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new
platform-generated external resource identifiers. Clients must still treat
the value as opaque. Not every path parameter is guaranteed to be v7 solely
because it is a UUID; use this schema where the contract asserts UUIDv7.
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"
Webhook endpoint identifier (UUIDv7).
UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new
platform-generated external resource identifiers. Clients must still treat
the value as opaque. Not every path parameter is guaranteed to be v7 solely
because it is a UUID; use this schema where the contract asserts UUIDv7.
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"
Webhook delivery identifier (UUIDv7). Distinct from event and attempt ids.
UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new
platform-generated external resource identifiers. Clients must still treat
the value as opaque. Not every path parameter is guaranteed to be v7 solely
because it is a UUID; use this schema where the contract asserts UUIDv7.
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"
Response
Delivery detail
Customer-visible delivery inspection record (ADR-021 WH-07 / DEC-WH-D01). Separates event, delivery, and attempt identity.
HTTP success criterion: any status in 200–299 marks delivery
succeeded. That does not guarantee the receiving application
successfully processed the event.
Never exposes signing secrets, credentials, internal hosts, queue ids, or stack traces.
UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new
platform-generated external resource identifiers. Clients must still treat
the value as opaque. Not every path parameter is guaranteed to be v7 solely
because it is a UUID; use this schema where the contract asserts UUIDv7.
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"
UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new
platform-generated external resource identifiers. Clients must still treat
the value as opaque. Not every path parameter is guaranteed to be v7 solely
because it is a UUID; use this schema where the contract asserts UUIDv7.
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"
UUID with version nibble 7 (UUIDv7). STD-API-01 prefers UUIDv7 for new
platform-generated external resource identifiers. Clients must still treat
the value as opaque. Not every path parameter is guaranteed to be v7 solely
because it is a UUID; use this schema where the contract asserts UUIDv7.
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"018f3c4e-7b2a-7c3d-8e9f-0123456789ab"
Approved public delivery statuses (DEC-WH-D01). Internal queue/worker states are not exposed.
| Status | Meaning |
|---|---|
| pending | Delivery created; no attempt started |
| in_progress | Delivery attempt currently executing |
| succeeded | Destination acknowledged with HTTP 2xx (200–299). Does not guarantee application-level processing success. |
| retry_scheduled | Previous attempt failed; another attempt is scheduled within the 24h retry window |
| failed_exhausted | Retry policy or 24h retry window exhausted |
| cancelled | Delivery intentionally terminated before success |
pending, in_progress, succeeded, retry_scheduled, failed_exhausted, cancelled "succeeded"
"retry_scheduled"
x >= 0RFC 3339 date-time. Response timestamps are UTC with a Z offset
(STD-API-01 D06). Client-supplied timestamps must include an explicit offset;
local times without an offset are rejected.
"2026-10-13T09:00:00.000Z"
100 <= x <= 599RFC 3339 date-time. Response timestamps are UTC with a Z offset
(STD-API-01 D06). Client-supplied timestamps must include an explicit offset;
local times without an offset are rejected.
"2026-10-13T09:00:00.000Z"
RFC 3339 date-time. Response timestamps are UTC with a Z offset
(STD-API-01 D06). Client-supplied timestamps must include an explicit offset;
local times without an offset are rejected.
"2026-10-13T09:00:00.000Z"