> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # List the outbox facts this gateway destroyed > Walks the terminal INVALID rows of this tenant's outbox, oldest first: the money facts this gateway DESTROYED. The dispatcher never retries a row here, and switching a relay on afterwards recovers nothing. POST /v1/consignado/event-delivery/invalid/{id}/requeue puts one row back in the dispatcher's queue; this operation is a read and moves nothing. The event PAYLOAD never leaves the store. It is the whole envelope of the fact, business data and CPF included, and an operator deciding what to do about a destroyed fact does not need its body. The recorded failure text does not leave either: it travels as 'last_error_class', a MECHANISM, because a publish error can carry a tenant identifier, a contract number or a rail payload. 'unclassified' covers both a message no rule recognises and a row with no message at all, which are the same thing to an operator. 'event_type' is the stable relay type the dispatcher routed on, not the business fact's name: the concrete fact rides inside the envelope this read never opens. 'id' is the id the requeue operation takes. There is deliberately NO status filter and NO time window. INVALID is the only status a cursor is correct over, because only an explicit requeue moves a row out of it, and a window would hide exactly the old destroyed fact nobody ever noticed, which is what this surface exists to show. Paging is keyset over the row's creation instant and its id. Send the previous page's page.next_after as after. has_more is true exactly when another page exists, and next_after is null exactly when it is false, so a client loop may terminate on either. The cursor never expires; a cursor this service did not mint is refused with 422 rather than silently restarting the scan from the top. It answers from a LOCAL table and never reaches the Dataprev rail, so it cannot answer 501. The tenant is derived from the validated identity and is never read from the request. ## OpenAPI ````yaml /pt/openapi/v3-current/consignado.yaml get /v1/consignado/event-delivery/invalid openapi: 3.1.0 info: contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for Lerian Consignado — Dataprev. The API covers tenant credentials and rail configuration, worker margin, loan auctions and bids, contract registration and lifecycle, B3 instrument codes, disbursement confirmation, portability, refinancing, renegotiation, FGTS guarantees, reconciliation, funds, assignments, throughput, and event subscriptions. license: name: Lerian Studio General License title: Lerian Consignado API version: v1.0.0 servers: - url: https://br-consignado-gw.sandbox.lerian.net security: - BearerAuth: [] tags: - description: >- Per-tenant Dataprev credential custody and public rail configuration (upload, status, rotation, revoke, requester code, and worker portal base URL) name: Credentials - description: >- Per-tenant streaming-hub subscription control-plane (list, create, get, rotate, revoke, and test delivery) name: Subscriptions - description: >- Dataprev payroll-rail surface: FGTS balance and authorization reads, the FGTS guarantee execution, contract suspension, reactivation and term changes, the rail's own contract documents, and the on-demand reads of leilão solicitações, escriturações, repasses and employment terminations name: Consignado Rail - description: >- Synchronous rail command surface: the operations a bancarizador without the lender drives over HTTP. name: Consignado Rail Commands - description: >- Gateway-owned disbursement confirmation: a client bank recording money it has ALREADY paid to a worker. It crosses no government boundary and proxies no Dataprev operation. name: Consignado Disbursement - description: >- Per-tenant self-service outbound Dataprev rail throughput: read and set this tenant's own requests-per-second, including a deliberate pause at zero name: Consignado Throughput - description: >- The B3 instrument code (Código IF) of an averbado contract: informed once by the bancarizador after B3 registers the CCB, and read back name: Consignado Registro B3 paths: /v1/consignado/event-delivery/invalid: get: tags: - Consignado Event Delivery summary: List the outbox facts this gateway destroyed description: >- Walks the terminal INVALID rows of this tenant's outbox, oldest first: the money facts this gateway DESTROYED. The dispatcher never retries a row here, and switching a relay on afterwards recovers nothing. POST /v1/consignado/event-delivery/invalid/{id}/requeue puts one row back in the dispatcher's queue; this operation is a read and moves nothing. The event PAYLOAD never leaves the store. It is the whole envelope of the fact, business data and CPF included, and an operator deciding what to do about a destroyed fact does not need its body. The recorded failure text does not leave either: it travels as 'last_error_class', a MECHANISM, because a publish error can carry a tenant identifier, a contract number or a rail payload. 'unclassified' covers both a message no rule recognises and a row with no message at all, which are the same thing to an operator. 'event_type' is the stable relay type the dispatcher routed on, not the business fact's name: the concrete fact rides inside the envelope this read never opens. 'id' is the id the requeue operation takes. There is deliberately NO status filter and NO time window. INVALID is the only status a cursor is correct over, because only an explicit requeue moves a row out of it, and a window would hide exactly the old destroyed fact nobody ever noticed, which is what this surface exists to show. Paging is keyset over the row's creation instant and its id. Send the previous page's page.next_after as after. has_more is true exactly when another page exists, and next_after is null exactly when it is false, so a client loop may terminate on either. The cursor never expires; a cursor this service did not mint is refused with 422 rather than silently restarting the scan from the top. It answers from a LOCAL table and never reaches the Dataprev rail, so it cannot answer 501. The tenant is derived from the validated identity and is never read from the request. operationId: listConsignadoInvalidEvents parameters: - description: >- The previous page's page.next_after. Omitted starts at the oldest destroyed fact. A cursor this service did not mint is refused, never restarted from the top. explode: false in: query name: after schema: description: >- The previous page's page.next_after. Omitted starts at the oldest destroyed fact. A cursor this service did not mint is refused, never restarted from the top. examples: - >- eyJ2IjoxLCJyIjoiYm9hcmQiLCJ0IjoiMjAyNi0wOC0xNFQwOToxMjozM1oiLCJrIjpbImMwMDEyIl19 type: string - description: >- Maximum number of destroyed facts to return. Omitted means the ceiling of 200. explode: false in: query name: limit schema: description: >- Maximum number of destroyed facts to return. Omitted means the ceiling of 200. examples: - 50 format: int64 maximum: 200 minimum: 1 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/InvalidEventsPage' description: OK '401': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unauthorized '403': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Forbidden '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '429': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Too Many Requests '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error security: - BearerAuth: [] components: schemas: InvalidEventsPage: additionalProperties: false properties: items: items: $ref: '#/components/schemas/InvalidEventItem' type: array page: $ref: '#/components/schemas/KeysetPageMetadata' required: - items - page type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable product error code. One of the enumerated values: the CLT-NNNN catalog codes for the general refusal classes; the named command conflicts, which a client branches on to tell one conflict from another; the four terminal refusals IDEMPOTENCY_STATE_UNRECOGNISED, IDEMPOTENCY_RECORD_UNREADABLE, IDEMPOTENCY_OUTCOME_UNRECORDED and IDEMPOTENCY_REPLAY_UNAVAILABLE (422), which tell the client to reconcile the original request and never retry under a new key; IDEMPOTENCY_KEY_REUSE (422): the key is spent on a different request, so send a new key; the codes a single surface answers, named after it (FUNDO_*, CESSAO_*, REGISTRO_B3_*, ...); and the 5xx codes naming an upstream (DATAPREV_*, STREAMING_HUB_*, TENANT_MANAGER_*, the Access Manager's AUT-0033 and AUT-1021) or an unknown outcome, whose detail is client-readable. enum: - AUT-0033 - AUT-1021 - AVERBACAO_ARTIFACT_CONFLICT - AVERBACAO_CLAIM_CONFLICT - AVERBACAO_DOCUMENTATION_CONFLICT - AVERBACAO_EXCLUDED - AVERBACAO_HELD_BY_ANOTHER_SENDER - AVERBACAO_NOT_ACCEPTED - AVERBACAO_OPERATIONS_INTERNAL - AVERBACAO_OPERATIONS_INVALID_CURSOR - AVERBACAO_OPERATIONS_INVALID_QUERY - AVERBACAO_OPERATIONS_UNKNOWN_STATUS - AVERBACAO_OPERATION_NOT_FOUND - BID_NO_PROPOSTA_LEFT - BID_ORIGINADOR_INACTIVE - BID_ORIGINADOR_UNKNOWN - BID_PROPOSAL_SLOT_TAKEN - BID_SOLICITACAO_TAKEN - BID_SOLICITACAO_UNKNOWN - BID_SUBMISSIONS_INTERNAL - BID_SUBMISSIONS_INVALID_CURSOR - BID_SUBMISSIONS_UNKNOWN_SITUATION - BOOKING_FIELD_INVALID - CEDED_CREDIT_INTERNAL - CEDED_CREDIT_NO_FUND_ENTITLEMENT - CEDED_CREDIT_UNAVAILABLE - CESSAO_CEDED_TO_OTHER_FUND - CESSAO_CREDIT_NOT_ACCEPTED - CESSAO_CREDIT_NOT_FOUND - CESSAO_CREDIT_NOT_WITNESSED - CESSAO_CREDIT_PENDING - CESSAO_FUNDO_NOT_ATTRIBUTED - CESSAO_INTERNAL - CESSAO_INVALID_INPUT - CESSAO_UNAVAILABLE - CESSAO_UNWIRED - CLT-0001 - CLT-0002 - CLT-0003 - CLT-0004 - CLT-0005 - CLT-0006 - CLT-0007 - CLT-0008 - CLT-0009 - CLT-0010 - CLT-0011 - CONTRACT_ALREADY_REGISTERED - CONTRACT_NOT_BOOKABLE - CURSOR_EXPIRED - CURSOR_FENCE_MISMATCH - DATAPREV_CREDENTIAL_REJECTED - DATAPREV_CREDENTIAL_REQUIRED - DATAPREV_CREDENTIAL_REVOKED - DATAPREV_INVALID_RESPONSE - DATAPREV_TIMEOUT - DATAPREV_UNAVAILABLE - DECLARED_DATES_OUT_OF_ORDER - DECLARED_TERMS_INCONSISTENT - DISBURSEMENT_CONFIRMATIONS_INTERNAL - DISBURSEMENT_CONFIRMATIONS_INVALID_CURSOR - DISBURSEMENT_PAYMENT_CONFLICT - EVENT_DELIVERY_INTERNAL - EXCLUSION_AUTHORITY_CONFLICT - EXCLUSION_BOOKING_IDENTITY_INCOMPLETE - EXCLUSION_DOCUMENTATION_UNDERWAY - EXCLUSION_OPERATIONS_INTERNAL - EXCLUSION_OPERATIONS_INVALID_CURSOR - EXCLUSION_OPERATIONS_INVALID_QUERY - EXCLUSION_OPERATIONS_UNKNOWN_STATUS - EXCLUSION_OPERATION_NOT_FOUND - FGTS_EXECUTION_ALREADY_REFUSED - FGTS_EXECUTION_CONTRACT_TAKEN - FGTS_EXECUTION_OUTCOME_UNRESOLVED - FGTS_EXECUTION_PAYLOAD_MISMATCH - FIRST_DEDUCTION_BEFORE_COMPETENCIA - FORMALIZATION_DEADLINE_EXCEEDED - FUNDO_CNPJ_CONFLICT - FUNDO_DEACTIVATED - FUNDO_INTERNAL - FUNDO_INVALID_ID - FUNDO_INVALID_INPUT - FUNDO_NOT_FOUND - FUNDO_NOT_REGISTERED - FUNDO_REF_CONFLICT - FUNDO_UNAVAILABLE - IDEMPOTENCY_KEY_REUSE - IDEMPOTENCY_OUTCOME_UNRECORDED - IDEMPOTENCY_RECORD_UNREADABLE - IDEMPOTENCY_REPLAY_UNAVAILABLE - IDEMPOTENCY_STATE_UNRECOGNISED - INVALID_CONTRACT_NUMBER - INVALID_CURSOR - INVALID_EVENTS_INVALID_CURSOR - INVALID_EVENT_NOT_FOUND - INVALID_EVENT_NOT_REQUEUEABLE - INVALID_PAGE_LIMIT - INVENTORY_UNAVAILABLE - MARGIN_SNAPSHOT_INCONSISTENT - ORIGINADOR_INTERNAL - ORIGINADOR_INVALID_ID - ORIGINADOR_INVALID_INPUT - ORIGINADOR_NOT_FOUND - ORIGINADOR_REF_CONFLICT - ORIGINADOR_UNAVAILABLE - OUTCOME_UNKNOWN - PORTABILIDADE_WINDOW_EXPIRED - RAIL_COMMANDS_INTERNAL - RAIL_COMMANDS_INVALID_CURSOR - RAIL_COMMANDS_TENANT_REQUIRED - RAIL_COMMANDS_UNKNOWN_FILTER - RAIL_COMMAND_ALREADY_REFUSED - RAIL_COMMAND_ANSWER_NOT_RETAINED - RAIL_COMMAND_CLAIM_CONFLICT - RAIL_COMMAND_OUTCOME_UNRESOLVED - RAIL_COMMAND_PAYLOAD_MISMATCH - RATE_OUTSIDE_PRODUCT_RANGE - REGISTRATION_NOT_FOUND - REGISTRO_B3_AVERBACAO_NAO_CONFIRMADA - REGISTRO_B3_CONTRATO_NAO_ENCONTRADO - REGISTRO_B3_DATA_REGISTRO_INVALIDA - REGISTRO_B3_INTERNAL - REGISTRO_B3_JA_INFORMADO - REGISTRO_B3_NAO_INFORMADO - REGISTRO_B3_UNAVAILABLE - REGISTRO_B3_UNWIRED - REPASSE_EXPECTATIONS_INTERNAL - REPASSE_EXPECTATIONS_INVALID_CURSOR - REPASSE_EXPECTATIONS_UNKNOWN_SITUATION - REVERSAO_WINDOW_EXPIRED - SALDO_DEVEDOR_INTERNAL - SALDO_DEVEDOR_INVALID_CURSOR - SALDO_DEVEDOR_NOT_FOUND - SALDO_DEVEDOR_TENANT_REQUIRED - SALDO_DEVEDOR_UNAVAILABLE - STREAMING_HUB_TIMEOUT - STREAMING_HUB_UNAVAILABLE - TENANT_MANAGER_TIMEOUT - TENANT_MANAGER_UNAVAILABLE - THROUGHPUT_HISTORY_INTERNAL - THROUGHPUT_HISTORY_INVALID_CURSOR - THROUGHPUT_HISTORY_TENANT_REQUIRED - THROUGHPUT_HISTORY_UNAVAILABLE - THROUGH_REQUIRED - UNKNOWN_QUERY_PARAMETER type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object InvalidEventItem: additionalProperties: false properties: attempts: description: How many dispatch attempts were spent before the row went terminal. examples: - 5 format: int64 type: integer created_at: description: When the fact was written, in UTC. examples: - '2026-08-14T09:12:33Z' format: date-time type: string definition_key: description: >- The fact's definition key. Empty on a row that does not carry a published fact. examples: - consignado.averbacao.confirmed type: string event_id: description: >- The fact's CloudEvents id, the one consumers deduplicate on. Empty on a row that does not carry a published fact. examples: - 00000000-0000-724f-a88c-bc9e1812cb16 type: string event_type: description: >- The stable relay type the dispatcher routed on, not the business fact's name. examples: - lerian.streaming.publish type: string id: description: >- The outbox row's own identity, the id POST /v1/consignado/event-delivery/invalid/{id}/requeue takes to put this fact back in the dispatcher's queue. examples: - 0192f1a0-0000-7000-8000-00000000d301 type: string last_error_class: description: >- The class of the last recorded failure. Never the error message, which can carry a tenant identifier, a contract number or a rail payload. enum: - serialization - broker_refused - broker_unreachable - tenant_unresolved - unclassified examples: - serialization type: string subject: description: >- The fact's CloudEvents subject: the contract, request or record the fact is about. Empty for reconciliation and repasse facts, whose subject can carry an employer's CPF, and on a row that does not carry a published fact. examples: - contract-1 type: string updated_at: description: When the row last changed status, in UTC. examples: - '2026-08-14T09:18:02Z' format: date-time type: string required: - id - event_type - definition_key - subject - event_id - attempts - last_error_class - created_at - updated_at type: object KeysetPageMetadata: additionalProperties: false properties: after: description: >- The cursor this page resumed from, echoed back. Null when the read started at the beginning. examples: - >- eyJ2IjoxLCJyIjoiYm9hcmQiLCJ0IjoiMjAyNi0wOC0xNFQwOToxMjozM1oiLCJrIjpbImMwMDEyIl19 type: - string - 'null' has_more: description: Whether at least one further page exists. examples: - true type: boolean next_after: description: >- The cursor for the page after this one. Null exactly when has_more is false. examples: - >- eyJ2IjoxLCJyIjoiYm9hcmQiLCJ0IjoiMjAyNi0wOC0xNFQwOTowNzo1MVoiLCJrIjpbImMwMDM3Il19 type: - string - 'null' required: - after - next_after - has_more type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.