List the outbox facts this gateway destroyed
Walks the terminal INVALID rows of this tenant’s outbox, oldest first: the money facts this gateway DESTROYED.
A row here will never be published. Nothing retries it, and switching a relay on afterwards recovers nothing, so this page is a record rather than a queue. Nothing on this operation can move a fact: it is a read, and a screen that could retry a row would be a second publisher racing the dispatcher.
The event PAYLOAD never leaves the store. It is the whole envelope of the fact, business data and CPF included, and an operator deciding what to do about a destroyed fact does not need its body. The recorded failure text does not leave either: it travels as ‘last_error_class’, a MECHANISM, because a publish error can carry a tenant identifier, a contract number or a rail payload. ‘unclassified’ covers both a message no rule recognises and a row with no message at all, which are the same thing to an operator.
‘event_type’ is the stable relay type the dispatcher routed on, not the business fact’s name: the concrete fact rides inside the envelope this read never opens. ‘id’ is what an operator quotes when asking for a fact to be replayed by hand.
There is deliberately NO status filter and NO time window. INVALID is the only status a cursor is correct over, because it is the only one nothing moves a row out of, and a window would hide exactly the old destroyed fact nobody ever noticed, which is what this surface exists to show.
Paging is keyset over the row’s creation instant and its id. Send the previous page’s page.next_after as after. has_more is true exactly when another page exists, and next_after is null exactly when it is false, so a client loop may terminate on either. The cursor never expires; a cursor this service did not mint is refused with 422 rather than silently restarting the scan from the top.
It answers from a LOCAL table and never reaches the Dataprev rail, so it cannot answer 501. The tenant is derived from the validated identity and is never read from the request.
Authorizations
JWT bearer token issued by the identity provider.
Query Parameters
The previous page's page.next_after. Omitted starts at the oldest destroyed fact. A cursor this service did not mint is refused, never restarted from the top.
"eyJ2IjoxLCJyIjoiYm9hcmQiLCJ0IjoiMjAyNi0wOC0xNFQwOToxMjozM1oiLCJrIjpbImMwMDEyIl19"
Maximum number of destroyed facts to return. Omitted means the ceiling of 200.
1 <= x <= 20050

