> ## Documentation Index > Fetch the complete documentation index at: https://docs.dolfinai.co/llms.txt > Use this file to discover all available pages before exploring further. # List forwards this company rejected > Emails that reached this company's forwarding address but were not accepted, because the sender is not on the allowlist or the message failed email authentication. Only metadata is kept — the attachments are not stored. This is where a new company's first forwards land, so it is the place to find out who is trying to send and allow them. **Authentication.** An API key (`x-dolfin-api-key`) **or** a JWT Bearer token. When your credential grants access to more than one client, select one with the `x-dolfin-client-id` header. ## OpenAPI ````yaml get /v1/companies/{companyId}/forwarding-rejections openapi: 3.1.1 info: title: Dolfin API description: >- Dolfin API for AR & AP. Each operation documents its accepted credentials under **Authentication** — typically an `x-dolfin-api-key` header (with `x-dolfin-organisation-id`) or a JWT Bearer token. version: v1 servers: - url: https://api.dolfinai.co description: Production security: [] tags: - name: Users - name: TaxRates - name: Suppliers - name: Supplier Credit Notes - name: Bills - name: Payables - name: RecurringInvoices - name: Receivables - name: Purchase Orders - name: Products - name: Payments - name: Invoices - name: Organisations - name: Clients - name: MCP - name: Matching - name: Invoice Reminders - name: Industries - name: Gmail - name: Delivery Notes - name: Customers - name: Currencies - name: Credit Notes - name: Companies - name: BankPayments - name: Bank details - name: Auth - name: ApprovalPolicies - name: Agent paths: /v1/companies/{companyId}/forwarding-rejections: get: tags: - Companies summary: List forwards this company rejected description: >- Emails that reached this company's forwarding address but were not accepted, because the sender is not on the allowlist or the message failed email authentication. Only metadata is kept — the attachments are not stored. This is where a new company's first forwards land, so it is the place to find out who is trying to send and allow them. **Authentication.** An API key (`x-dolfin-api-key`) **or** a JWT Bearer token. When your credential grants access to more than one client, select one with the `x-dolfin-client-id` header. parameters: - name: companyId in: path required: true schema: type: string format: uuid - name: Limit in: query description: Maximum rejections to return, newest first. 1-100, default 20. schema: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string format: int32 default: 20 - name: x-dolfin-client-id in: header description: >- Target client. Required when your credential grants access to more than one client; omit when it resolves a single client. schema: type: string format: uuid responses: '200': description: OK content: application/json: schema: type: array items: $ref: '#/components/schemas/BillForwardingRejectionResponse' '400': description: Company.MissingClientId — client ID is required content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '403': description: >- Module.NotEntitled — the client's plan does not include the module this endpoint requires content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '404': description: >- Company.NotFound — the company does not exist or belongs to a different client content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' security: - ApiKey: [] - Bearer: [] components: schemas: BillForwardingRejectionResponse: required: - id - fromAddress - fromDomain - subject - attachmentCount - attachmentSummary - reason - authResult - dkimResult - spfResult - receivedAt type: object properties: id: type: string format: uuid fromAddress: type: string description: The sender the dropped forward came from. fromDomain: type: string subject: type: - 'null' - string attachmentCount: pattern: ^-?(?:0|[1-9]\d*)$ type: - integer - string description: Number of attachments on the dropped email. format: int32 attachmentSummary: type: - 'null' - string description: >- Short 'name (type)' summary of the attachments — the bytes are not stored. reason: $ref: '#/components/schemas/BillForwardingRejectionReason' description: 'Why it was dropped: SenderNotAllowed or AuthenticationFailed.' authResult: $ref: '#/components/schemas/EmailAuthResult' description: >- Overall email-auth (DKIM/DMARC) verdict for the sender: Pass, Fail or Unknown. dkimResult: $ref: '#/components/schemas/EmailAuthResult' description: >- Aligned-DKIM check: Pass (valid signature from the sender's domain), Fail, or Unknown. Render as a per-check tick/cross. spfResult: $ref: '#/components/schemas/EmailAuthResult' description: >- Aligned-SPF check: Pass (SPF passed for the sender's domain), Fail, or Unknown. Render as a per-check tick/cross. receivedAt: type: string description: When the dropped forward was received. format: date-time ProblemDetails: type: object properties: type: type: - 'null' - string title: type: - 'null' - string status: pattern: ^-?(?:0|[1-9]\d*)$ type: - 'null' - integer - string format: int32 detail: type: - 'null' - string instance: type: - 'null' - string BillForwardingRejectionReason: enum: - SenderNotAllowed - AuthenticationFailed EmailAuthResult: enum: - Unknown - Pass - Fail securitySchemes: ApiKey: type: apiKey description: >- An API key issued to your client. It carries the client's scope; org-scoped calls also require the `x-dolfin-organisation-id` header. Keys are created and revoked by a client administrator. name: x-dolfin-api-key in: header Bearer: type: http description: >- A session JWT obtained via the OAuth flow (`POST /auth/codes` → `POST /auth/exchange`). Its claims carry the caller's organisation and/or client scope. scheme: bearer bearerFormat: JWT ````