> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dolfinai.co/llms.txt
> Use this file to discover all available pages before exploring further.

# List bill forwards awaiting sender approval

> Returns recent bills forwarded to this organisation's inbound address that were dropped because the sender is not yet allowed (or failed email authentication) — the 'senders waiting' feed. Each entry identifies the sender so a user can allow them. Attachments are not stored; allowing a sender imports their future forwards, not these dropped ones.

**Authentication.** An API key (`x-dolfin-api-key`) **together with** the `x-dolfin-organisation-id` header identifying the organisation, **or** a JWT Bearer token that carries the organisation in its claims.



## OpenAPI

````yaml /api-reference/openapi.json get /v1/bills/forwarding-rejections
openapi: 3.1.1
info:
  title: Dolfin API
  description: >-
    Dolfin API for AR & AP. Each operation documents its accepted credentials
    under **Authentication** — typically an `x-dolfin-api-key` header (with
    `x-dolfin-organisation-id`) or a JWT Bearer token.
  version: v1
servers:
  - url: https://api.dolfinai.co
    description: Production
security: []
tags:
  - name: Users
  - name: TaxRates
  - name: Suppliers
  - name: Supplier Credit Notes
  - name: Bills
  - name: Payables
  - name: RecurringInvoices
  - name: Receivables
  - name: Purchase Orders
  - name: Products
  - name: Payments
  - name: Invoices
  - name: Organisations
  - name: Clients
  - name: MCP
  - name: Matching
  - name: Invoice Reminders
  - name: Industries
  - name: Gmail
  - name: Delivery Notes
  - name: Customers
  - name: Currencies
  - name: Credit Notes
  - name: Companies
  - name: BankPayments
  - name: Bank details
  - name: Auth
  - name: ApprovalPolicies
  - name: Agent
paths:
  /v1/bills/forwarding-rejections:
    get:
      tags:
        - Bills
      summary: List bill forwards awaiting sender approval
      description: >-
        Returns recent bills forwarded to this organisation's inbound address
        that were dropped because the sender is not yet allowed (or failed email
        authentication) — the 'senders waiting' feed. Each entry identifies the
        sender so a user can allow them. Attachments are not stored; allowing a
        sender imports their future forwards, not these dropped ones.


        **Authentication.** An API key (`x-dolfin-api-key`) **together with**
        the `x-dolfin-organisation-id` header identifying the organisation,
        **or** a JWT Bearer token that carries the organisation in its claims.
      parameters:
        - name: x-dolfin-organisation-id
          in: header
          description: >-
            Target organisation. **Required when authenticating with an API
            key**; omit for Bearer callers (resolved from the token).
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/BillForwardingRejectionResponse'
        '403':
          description: >-
            Module.NotEntitled — the client's plan does not include the module
            this endpoint requires
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      security:
        - ApiKey: []
        - Bearer: []
components:
  schemas:
    BillForwardingRejectionResponse:
      required:
        - id
        - fromAddress
        - fromDomain
        - subject
        - attachmentCount
        - attachmentSummary
        - reason
        - authResult
        - dkimResult
        - spfResult
        - receivedAt
      type: object
      properties:
        id:
          type: string
          format: uuid
        fromAddress:
          type: string
          description: The sender the dropped forward came from.
        fromDomain:
          type: string
        subject:
          type:
            - 'null'
            - string
        attachmentCount:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
            - integer
            - string
          description: Number of attachments on the dropped email.
          format: int32
        attachmentSummary:
          type:
            - 'null'
            - string
          description: >-
            Short 'name (type)' summary of the attachments — the bytes are not
            stored.
        reason:
          $ref: '#/components/schemas/BillForwardingRejectionReason'
          description: 'Why it was dropped: SenderNotAllowed or AuthenticationFailed.'
        authResult:
          $ref: '#/components/schemas/EmailAuthResult'
          description: >-
            Overall email-auth (DKIM/DMARC) verdict for the sender: Pass, Fail
            or Unknown.
        dkimResult:
          $ref: '#/components/schemas/EmailAuthResult'
          description: >-
            Aligned-DKIM check: Pass (valid signature from the sender's domain),
            Fail, or Unknown. Render as a per-check tick/cross.
        spfResult:
          $ref: '#/components/schemas/EmailAuthResult'
          description: >-
            Aligned-SPF check: Pass (SPF passed for the sender's domain), Fail,
            or Unknown. Render as a per-check tick/cross.
        receivedAt:
          type: string
          description: When the dropped forward was received.
          format: date-time
    ProblemDetails:
      type: object
      properties:
        type:
          type:
            - 'null'
            - string
        title:
          type:
            - 'null'
            - string
        status:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
            - 'null'
            - integer
            - string
          format: int32
        detail:
          type:
            - 'null'
            - string
        instance:
          type:
            - 'null'
            - string
    BillForwardingRejectionReason:
      enum:
        - SenderNotAllowed
        - AuthenticationFailed
    EmailAuthResult:
      enum:
        - Unknown
        - Pass
        - Fail
  securitySchemes:
    ApiKey:
      type: apiKey
      description: >-
        An API key issued to your client. It carries the client's scope;
        org-scoped calls also require the `x-dolfin-organisation-id` header.
        Keys are created and revoked by a client administrator.
      name: x-dolfin-api-key
      in: header
    Bearer:
      type: http
      description: >-
        A session JWT obtained via the OAuth flow (`POST /auth/codes` → `POST
        /auth/exchange`). Its claims carry the caller's organisation and/or
        client scope.
      scheme: bearer
      bearerFormat: JWT

````