# Manage read access and webhook delivery

Issue scoped credentials, review signed subscriptions and explicitly repair retained event gaps.

Source: https://help.smartfact.ai/manuals/refillflow/integrations-and-delivery

Review edition: 25 October 2026

Roles: owner

An owner uses **Integrations** at the real site to allow another system to read refills and receive signed events. These interfaces do not request, receive or change a refill, and their notifications are not instructions to adjust stock. Changes need recent Accounts verification and applicable current integration permission.

## Issue and withdraw scoped read access

Under **Issue a credential**, enter **Name (which system uses it)** and choose **What it may read**. Select only the required **Read refills** and/or **Read events** scope. Enter whole **Expires after** days from 1 to 365 and **Requests a minute** from 1 to 600, then choose **Issue the credential**. The site allows at most ten active, unexpired credentials.

Copy the token immediately from **Copy the new token now** into the receiving system's secret store. It is shown once and is not an operator sign-in. Keep the credential's name, key ID, scopes and expiry in the administrative handover, without putting its token in a URL, email or spreadsheet.

In **Credentials**, check state and expiry rather than treating **Last used** as a full audit of reads. To remove access, enter **Why it is revoked** with 10 to 500 Unicode characters and choose **Revoke**. A lost token requires revocation and a replacement, rather than retrieval of the old secret. Check current metadata before issuing another if the earlier answer was lost.

## Review destinations before subscribing

Under **Allowed destinations**, add the receiver's HTTPS origin, such as its scheme and host, through the displayed allowlist form. The destination must resolve only to public addresses; redirects are not followed. A subscription's full receiving URL must be on an allowed origin. Ask the receiving-system administrator to correct an address refusal; do not replace it with a private address or an unrelated destination.

Create the subscription with **Name**, **URL (on an allowed destination)** and the intended **Events**, then choose **Subscribe**. Subscriptions begin with future events; earlier history is never sent automatically. If the page says sending is off, subscriptions can collect events but no delivery occurs until the installation permits sending. Do not mistake creating a subscription for a successful external delivery.

Copy **Copy the signing secret now**, including its key ID, to the authorised receiver. The displayed secret is base64-encoded. The receiver must verify signatures and deduplicate by event ID. Events and their bodies can also be reconciled through the read feed; a partial leg receipt is distinct from a completed refill.

## Pause, rotate or withdraw deliberately

On the exact subscription, **Pause** makes new events wait; **Resume** allows that subscription to continue under current permission. **Issue a new signing secret** replaces its signing secret, shown once. Coordinate the receiver's verification change before rotating it.

**Revoke** needs **Why it is revoked**, 10 to 500 Unicode characters. **Remove** on an allowed origin needs **Why it is removed**. These are administrative withdrawal decisions, not acknowledgements that a receiver processed its earlier events. Keep retained delivery and gap evidence available for reconciliation.

## Read what needs a person

Inspect **Needs a person** for each event's subscription, state, cause, attempts and latest attempt time. **Parked** needs investigation. **Retained** means no acknowledgement within the retry window. **Withheld** means the plan did not allow sending. Restore or disclosure restrictions can also prevent a replay until the responsible condition has been resolved.

For a disclosed gap, **Not sent while the plan stopped disclosure** shows its time range, event count and any events later deleted with retained refill history. Deleted event bodies cannot be recreated by replay. Keep that limitation in the receiver's reconciliation, using the surviving records rather than assuming a complete replay is possible.

## Preview and authorise the exact replay

Under **Send events again**, select **Subscription** and **What**: **Everything parked, retained or withheld**, or **A range of events** with **First event ID** and **Last event ID**. A gap's **Prepare a replay of this range** fills that scope. Use **Preview** before deciding.

Read the number never sent, already delivered, previously attempted and deleted. At most 1,000 events are selected at a time. If duplicates are possible, agree receiver deduplication and tick **I understand the receiver will get duplicates**. Enter **Why**, 10 to 500 Unicode characters, then choose **Send again** with current verification.

The same events keep their IDs and bodies. The replay queues delivery; it is not a new refill action or proof of acknowledgement. Inspect **Recent replays** and later delivery outcomes. Retain the subscription, event range, preview counts, duplicate decision, reason and receiving-system investigation owner. If an answer is missing, inspect those retained records before requesting another replay.