# impartire API — Reference: Inbound deliveries

Every path is under `https://impartire.com/api/v1`. The machine-readable contract is https://impartire.com/api/v1/openapi.json (OpenAPI 3.1).

#### GET /api/v1/inbound-deliveries

List deliveries made to the org

The receiver's view: what other orgs delivered to yours through a supply link, newest first, with where each landed in your org. For an OAuth token, its person needs the read-delivery permission (no platform-admin bypass); a key reads the whole org. 404 when the org does not have delivery, and for an OAuth token whose person may not read it. Also 404 when the org does not have supply links.

Scopes: `delivery:read`

Parameters:

- `status` (query, "pending" | "delivered" | "failed" | "rejected") — Only deliveries with this status.
- `created_after` (query, string (date-time)) — Only deliveries created strictly after this instant (ISO 8601 with offset), compared to the millisecond.
- `limit` (query, integer) — Page size, default 50. Values above 100 are treated as 100.
- `cursor` (query, string) — next_cursor from the previous page, with the other parameters unchanged.

Response 200 — `InboundDeliveryList`

- `data` (array of InboundDelivery, required) — Newest first (by `created_at`, then id).
  - `id` (string (uuid), required)
  - `supplier_org` (object, required) — The org that delivered.
    - `id` (string (uuid), required)
    - `name` (string, required)
  - `asset_name` (string or null, required) — The supplier's asset name.
  - `spec_profile` (SpecProfileRef or null, required) — Your spec revision it was delivered against.
    - `id` (string (uuid), required)
    - `name` (string, required)
    - `revision` (integer, required) — The spec's revision: a published spec changes only by a new revision, which supersedes this one.
  - `status` ("pending" | "delivered" | "failed" | "rejected", required)
  - `received` (object or null, required) — Where the delivery landed in your org; null until it has.
    - `asset_id` (string (uuid) or null, required) — Your asset the delivery landed as (GET /api/v1/assets/{id}).
    - `file_id` (string (uuid) or null, required) — The landed primary file.
    - `sha256` (string or null, required) — The landed primary file's SHA-256 (lowercase hex).
    - `landed_at` (string or null, required) — When it landed (ISO 8601).
    - `redelivery` (boolean, required) — True when it landed as a new version of an asset an earlier delivery landed.
  - `rejection_note` (string or null, required) — Why you rejected it, when you did.
  - `error` (string or null, required)
  - `created_at` (string (date-time), required)
  - `delivered_at` (string (date-time) or null, required)
- `next_cursor` (string or null, required) — Pass as `cursor` to get the next page; null means this is the last page.

Other responses:

- 401 (Problem) — unauthenticated — no key, or an unknown, revoked or expired one.
- 403 (Problem) — insufficient-scope — the key lacks a required scope.
- 404 (Problem) — not-found.
- 422 (Problem) — validation — a bad filter, `limit` or `cursor` (`errors[].path` names it).
- 429 (Problem) — rate-limited — the key's request budget is spent; wait Retry-After seconds.
- 500 (Problem) — internal.