> ## Documentation Index
> Fetch the complete documentation index at: https://developers.1-funnel.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Business scoping

> How businessId, grants, and permissions combine for authorization.

<Warning>
  **Developer Preview**

  This documentation describes the upcoming 1Funnel External Integration API.

  The documented API endpoints and authentication services are not yet available
  for public integration.

  You can explore the API specifications, request and response schemas, webhook
  events, and integration guides.

  Sandbox and production availability will be announced separately.
</Warning>

Every External Integration API route is business-scoped:

```text theme={null}
/v1/businesses/{businessId}/...
```

`businessId` selects the business resource. It is **not** proof of access.

## Authorization checks

For each request the platform evaluates:

1. Valid external access token and application identity
2. Active application-to-business grant for that `businessId`
3. Required resource permission for the operation
4. Resource ownership / isolation

Missing grant or permission yields `403` (or `401` when authentication fails).

## Permissions (v1 catalogue)

Exactly 13 approved permissions exist, including `sms.message.send`,
`wallet.balance.read`, `otp.challenge.verify`, and `webhook.endpoint.write`.
See the OpenAPI permission catalogue for the full list.

Tenant-owned integration applications receive grants per business. Do not
assume cross-business access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.