ClickFunnels Webhooks::Incoming::External Purchase Event API

openapi: 3.2.0
info:
  title: ClickFunnels Webhooks::Incoming::External Purchase Event API
  termsOfService: https://www.clickfunnels.com/terms-of-service
  contact:
    name: ClickFunnels API Team
    url: https://developers.myclickfunnels.com
  x-logo:
    url: https://statics.myclickfunnels.com/image/1126065/file/31edf05760fafe41a82f16a668ab251f.png
  description: 'The ClickFunnels REST API that powers webhooks, native integrations, and Zapier lets you manage your ClickFunnels data, automate your workflows, and recreate ClickFunnels functionality in your own apps.


    ### For AI agents


    This document is the catalogue: every operation ClickFunnels exposes over REST is described here, with a unique operationId, typed schemas, and the scopes it needs. It is served from `/openapi.json`, `/openapi.yaml`, `/api/openapi.{json,yaml}`, and `/api/v2/openapi.{json,yaml}` on the accounts host.


    Three things it does not describe, each one request away:


    - MCP server: the app-native Model Context Protocol server (Streamable HTTP, OAuth 2.1 with PKCE). Prefer it over raw REST when your client supports MCP - it describes itself at runtime.

    - Skill guides, also as an Agent Skills index: one task guide per job (pages, blogs, products, orders, workflows, emails, courses, stats, external SDK pages). Read the guide that matches your job before your first write. llms.txt covers when to use ClickFunnels at all, how to get credentials, and how to behave around rate limits.

    - Protected resource metadata (RFC 9728) and authorization server metadata (RFC 8414): the scope vocabulary and the OAuth endpoints. Dynamic client registration is for MCP clients only.


    On ClickFunnels-owned API hosts (`myclickfunnels.com` and its subdomains), the OpenAPI specification responses and API authentication failures (401, or 403 for insufficient scope) carry those links in an RFC 8288 `Link` header, so clients can discover the documentation and authentication metadata from those responses. Requests sent through a customer''s custom domain keep the Bearer challenge but omit those discovery pointers.'
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
  version: 2.0.0
servers:
- url: https://{subdomain}.myclickfunnels.com/api/v2
  description: ClickFunnels API
  variables:
    subdomain:
      default: myworkspace
security:
- BearerAuth: []
- OAuth2: []
tags:
- name: Webhooks::Incoming::ExternalPurchaseEvent
  description: Raw deliveries received by incoming external purchase endpoints and their processing outcomes.
paths:
  /webhooks/incoming/external_purchase_endpoints/{endpoint_id}/events:
    get:
      tags:
      - Webhooks::Incoming::ExternalPurchaseEvent
      summary: List Incoming External Purchase Events
      description: 'List the raw events received by one incoming external purchase endpoint. Events can

        exist without a ClickFunnels order; in that case `order_id` is null. Read a single event

        to get its raw `payload`.'
      operationId: listWebhooksIncomingExternalPurchaseEvents
      parameters:
      - name: endpoint_id
        in: path
        required: true
        schema:
          type: string
        description: Integer ID or obfuscated public ID of the incoming external purchase endpoint.
      - $ref: '#/components/parameters/after'
      - $ref: '#/components/parameters/per_page'
      - $ref: '#/components/parameters/sort_order'
      - $ref: '#/components/parameters/sort_property'
      - name: filter
        in: query
        description: 'Filter by `id`, `event_type` or `processing_status`, like this: `?filter[event_type]=payment.succeeded&filter[processing_status]=success`. All about filtering [here](https://developers.myclickfunnels.com/docs/filtering).'
        required: false
        style: deepObject
        explode: true
        schema:
          type: object
          properties:
            id:
              type: string
            event_type:
              type: string
            processing_status:
              type: string
      responses:
        '200':
          description: OK
          headers:
            Pagination-Next:
              $ref: '#/components/headers/PaginationNext'
            Link:
              $ref: '#/components/headers/Link'
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/WebhooksIncomingExternalPurchaseEventAttributes'
              example:
              - id: 301
                public_id: WhEvtA
                workspace_id: 42000
                external_purchase_endpoint_id: 81
                order_id: null
                event_type: membership.activated
                external_event_id: evt_abc123
                processed_at: null
                processing_status: null
                processing_errors: null
                created_at: '2026-08-26T12:30:00.000Z'
                updated_at: '2026-08-26T12:30:00.000Z'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  hint:
                    type:
                    - string
                    - 'null'
                    description: 'The next step for the caller: how to authenticate, which scope was missing, or where the route list lives. Always present, and null when this error has no next step to offer.'
              example:
                error: API key missing or invalid
                hint: 'Send the token as `Authorization: Bearer <token>`. Create one under Account > Team > Platform Applications (a workspace API key), or obtain one with OAuth 2.1; both use the same scopes. See https://developers.myclickfunnels.com/docs/authentication, or append .md to that URL for markdown.'
        '403':
          description: The access token does not grant read access to Webhooks.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  hint:
                    type:
                    - string
                    - 'null'
                    description: 'The next step for the caller: how to authenticate, which scope was missing, or where the route list lives. Always present, and null when this error has no next step to offer.'
              example:
                error: 'Forbidden: This access token''s scopes do not grant read access to Webhooks. Granted scopes: contacts:read.'
                hint: 'Scopes are granted per category as <category>:read or <category>:write; the `scope` parameter of WWW-Authenticate names the one this request needed. Grantable scopes: https://accounts.myclickfunnels.com/.well-known/oauth-protected-resource'
        '404':
          description: The endpoint does not exist or belongs to an inaccessible workspace.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  hint:
                    type:
                    - string
                    - 'null'
                    description: 'The next step for the caller: how to authenticate, which scope was missing, or where the route list lives. Always present, and null when this error has no next step to offer.'
              example:
                error: Not found
                hint: null
        '422':
          $ref: '#/components/responses/InvalidPageSize'
  /webhooks/incoming/external_purchase_events/{id}:
    get:
      tags:
      - Webhooks::Incoming::ExternalPurchaseEvent
      summary: Fetch Incoming External Purchase Event
      description: Retrieve one raw external purchase event, its raw `payload` and its processing outcome.
      operationId: getWebhooksIncomingExternalPurchaseEvents
      parameters:
      - $ref: '#/components/parameters/id'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhooksIncomingExternalPurchaseEventAttributes'
              example:
                id: 301
                public_id: WhEvtA
                workspace_id: 42000
                external_purchase_endpoint_id: 81
                order_id: null
                event_type: membership.activated
                external_event_id: evt_abc123
                payload:
                  id: evt_abc123
                  type: membership.activated
                  data:
                    status: active
                processed_at: null
                processing_status: null
                processing_errors: null
                created_at: '2026-08-26T12:30:00.000Z'
                updated_at: '2026-08-26T12:30:00.000Z'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  hint:
                    type:
                    - string
                    - 'null'
                    description: 'The next step for the caller: how to authenticate, which scope was missing, or where the route list lives. Always present, and null when this error has no next step to offer.'
              example:
                error: API key missing or invalid
                hint: 'Send the token as `Authorization: Bearer <token>`. Create one under Account > Team > Platform Applications (a workspace API key), or obtain one with OAuth 2.1; both use the same scopes. See https://developers.myclickfunnels.com/docs/authentication, or append .md to that URL for markdown.'
        '403':
          description: The access token does not grant read access to Webhooks.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  hint:
                    type:
                    - string
                    - 'null'
                    description: 'The next step for the caller: how to authenticate, which scope was missing, or where the route list lives. Always present, and null when this error has no next step to offer.'
              example:
                error: 'Forbidden: This access token''s scopes do not grant read access to Webhooks. Granted scopes: contacts:read.'
                hint: 'Scopes are granted per category as <category>:read or <category>:write; the `scope` parameter of WWW-Authenticate names the one this request needed. Grantable scopes: https://accounts.myclickfunnels.com/.well-known/oauth-protected-resource'
        '404':
          description: The event does not exist or belongs to an inaccessible workspace.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  hint:
                    type:
                    - string
                    - 'null'
                    description: 'The next step for the caller: how to authenticate, which scope was missing, or where the route list lives. Always present, and null when this error has no next step to offer.'
              example:
                error: Not found
                hint: null
components:
  parameters:
    id:
      name: id
      in: path
      required: true
      schema:
        type: string
    per_page:
      name: per_page
      in: query
      required: false
      description: Records per page. Defaults to 20; raise it up to 100 for bulk reads. A larger value returns 100 records. Zero, a negative or a non-integer value is a 422. The `Link` next-page URL keeps the value, so a client following it keeps the page size. More [in our guides](https://developers.myclickfunnels.com/docs/pagination).
      schema:
        type: integer
        minimum: 1
        default: 20
    sort_property:
      name: sort_property
      in: query
      description: 'Sort property of a list response. The default is id and thus the created_at order.

        If you sort by other properties, we additionally sort by id implicitly as a secondary sort property, so that you can rely on the sort order to be deterministic even if the main sort property ends up with the same values.

        '
      required: false
      schema:
        type: string
        enum:
        - id
        - updated_at
    sort_order:
      name: sort_order
      in: query
      description: Sort order of a list response. Use 'desc' to reverse the default 'asc' (ascending) sort order. Examples [in our guides](https://developers.myclickfunnels.com/docs/pagination).
      required: false
      schema:
        type: string
        enum:
        - asc
        - desc
    after:
      name: after
      in: query
      required: false
      schema:
        type: string
      description: ID of item after which the collection should be returned. More examples and info about pagination [in our guides](https://developers.myclickfunnels.com/docs/pagination).
  responses:
    InvalidPageSize:
      description: Unprocessable Entity - `per_page` must be a positive integer.
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: string
              hint:
                type:
                - string
                - 'null'
                description: Next step for the caller, or null when no additional guidance applies.
          example:
            error: 'Request unprocessable: per_page must be a positive integer, capped at 100 (got "0")'
            hint: null
  schemas:
    WebhooksIncomingExternalPurchaseEventAttributes:
      type: object
      title: Incoming External Purchase Event
      description: 'A raw event received from an external purchase provider together with its processing

        outcome. The raw `payload` is returned only when reading a single event.

        '
      properties:
        id:
          type: integer
          description: Event ID.
        public_id:
          type: string
          description: Obfuscated event ID.
        workspace_id:
          type: integer
          description: Workspace that owns the endpoint which received this event.
        external_purchase_endpoint_id:
          type: integer
          description: Incoming external purchase endpoint that received this event.
        order_id:
          type:
          - integer
          - 'null'
          description: ClickFunnels order created or affected by this event, or null when no order is associated.
        event_type:
          type:
          - string
          - 'null'
          description: Provider event type, when supplied by the provider.
        external_event_id:
          type:
          - string
          - 'null'
          description: Provider's own ID for this delivery, when supplied. Use it to match an event against the provider's dashboard.
        payload:
          description: 'Raw provider payload, exactly as it arrived. Its shape depends on the provider and event

            type. Returned only when reading a single event, because a list of payloads would be

            almost entirely payload.

            '
        processed_at:
          type:
          - string
          - 'null'
          format: date-time
          description: Time processing completed, or null while unprocessed or after a failed attempt.
        processing_status:
          type:
          - string
          - 'null'
          enum:
          - pending
          - success
          - processing_skipped
          - decryption_failed
          - processing_failed
          - order_creation_failed
          - refund_processing_failed
          - chargeback_processing_failed
          - duplicate_webhook_event
          - creation_failed
          - no_origin_order_processing_ignored
          - null
          description: Current or final processing outcome, or null before processing starts.
        processing_errors:
          type:
          - string
          - 'null'
          description: Why the event changed nothing, or null when no reason was recorded.
        created_at:
          type: string
          format: date-time
          description: Created at.
        updated_at:
          type: string
          format: date-time
          description: Updated at.
      example:
        id: 301
        public_id: WhEvtA
        workspace_id: 42000
        external_purchase_endpoint_id: 81
        order_id: null
        event_type: membership.activated
        external_event_id: evt_abc123
        payload:
          id: evt_abc123
          type: membership.activated
          data:
            status: active
        processed_at: null
        processing_status: null
        processing_errors: null
        created_at: '2026-08-26T12:30:00.000Z'
        updated_at: '2026-08-26T12:30:00.000Z'
  headers:
    PaginationNext:
      description: ID of the last item in the current response after which more records exist. You can use it in an `after` query parameter for cursor-based pagination to get to the next page.
      schema:
        type: string
    Link:
      description: A direct link to the next page for the cursor-based pagination. It includes the `after` and the Pagination-Next ID value.
      schema:
        type: string
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: 'A workspace API key or an OAuth access token, sent as `Authorization: Bearer <token>`.


        Both carry the same scope vocabulary as the `OAuth2` scheme below. Category-only

        scopes restrict access to the categories they name. Coarse wildcards remain additive:

        `read contacts:read` reads every category, while `write contacts:read` can write every

        category. Omit coarse scopes when restricting access to specific categories.

        Legacy tokens with only coarse scopes retain their existing unrestricted access;

        a bare `read` scope alone does not enforce read-only access.

        '
    OAuth2:
      type: oauth2
      description: 'OAuth 2.0 authorization code flow for REST integrations. Create a Platform Application

        and follow `https://developers.myclickfunnels.com/docs/oauth-20` to connect users.

        Authorization server metadata is published at

        `https://accounts.myclickfunnels.com/.well-known/oauth-authorization-server`.

        Dynamic client registration at `/oauth/register` is for MCP clients only; MCP-scoped

        tokens must use `https://agents.myclickfunnels.com/mcp`, not the REST API.


        Scopes are least-privilege by category. Ask for the two coarse wildcards (`read`,

        `write`) only when an integration genuinely needs the whole workspace; otherwise ask

        for the `<category>:read` / `<category>:write` pairs you use. `write` implies `read`

        for the same category. Protected resource metadata (RFC 9728) for this API lives at

        `https://accounts.myclickfunnels.com/.well-known/oauth-protected-resource`.

        '
      flows:
        authorizationCode:
          authorizationUrl: https://accounts.myclickfunnels.com/oauth/authorize
          tokenUrl: https://accounts.myclickfunnels.com/oauth/token
          refreshUrl: https://accounts.myclickfunnels.com/oauth/token
          scopes:
            read: Read any resource in the granted workspaces
            write: Read and write any resource in the granted workspaces
            contacts:read: Read Contacts
            contacts:write: Read and write Contacts
            workflows:read: Read Workflows (Automations)
            workflows:write: Read and write Workflows (Automations)
            funnels:read: Read Funnels
            funnels:write: Read and write Funnels
            sites:read: Read Sites & Design
            sites:write: Read and write Sites & Design
            courses:read: Read Courses
            courses:write: Read and write Courses
            emails:read: Read Emails
            emails:write: Read and write Emails
            blog:read: Read Blog
            blog:write: Read and write Blog
            community:read: Read Community
            community:write: Read and write Community
            appointments:read: Read Appointments
            appointments:write: Read and write Appointments
            opportunities:read: Read Opportunities
            opportunities:write: Read and write Opportunities
            store:read: Read Store
            store:write: Read and write Store
            forms:read: Read Forms
            forms:write: Read and write Forms
            media:read: Read Media
            media:write: Read and write Media
            webhooks:read: Read Webhooks
            webhooks:write: Read and write Webhooks
            account:read: Read Account
            account:write: Read and write Account
            reference:read: Read Reference Data
            reference:write: Read and write Reference Data
externalDocs:
  description: More in-depth guides and further resources
  url: https://developers.myclickfunnels.com
x-provenance:
  method: harvested
  publisher: ClickFunnels
  source: https://accounts.myclickfunnels.com/openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)