ShopEazydevelopers
API referenceMerchant API BetaPurchasing

Draft an order to a supplier

Beta
Credentials
  • OAuth access token
Scopes
listings:write
Subscription
Needs an active plan. Otherwise 403 subscription_locked.
Plan
Scale. A plan without it gets 403 plan_limit.
Idempotency
Send an Idempotency-Key header. A retry with the same key does the work once.
POST
/v1/merchant/stores/{storeId}/purchase-orders

For materials (materialId) or stock the shop buys in (listingId). Scale. It starts as a draft: mark it sent with the status operation.

Plan: Scale (403 plan_limit on a plan without it). Reading and changing what already exists stays open after a downgrade.

Access: OAuth scope listings:write; write-gated by the subscription.

Authorization

merchantOAuth listings:write
headerAuthorizationBearer <token>

OAuth 2.1 (authorization code + PKCE S256, public clients, dynamic registration) for connected AI apps. Effective power is scopes granted AND the person's role today AND the plan. orders:refund, billing:write and team:write are opt-in on the consent screen. Write implies read for marketing:read and messages:read, so a grant holding marketing:write passes a marketing:read check, and messages:send passes messages:read.

Scope: listings:write

Path Parameters

storeId*string

A store the person can reach. Any other id answers 404, never 403.

Header Parameters

Idempotency-Key*string

Required on every write. Minted on the device when the person taps, reused on every retry. A write without one, or with one that does not match the pattern, is refused with 422 validation_error. Scoped to the token's subject, remembered 24 hours. A replay returns the first 2xx response with Idempotent-Replay: true; a request still running answers 409 in_flight; the same key with a different method, path or body answers 409 idempotency_key_reused; non-2xx results are not remembered. If the key store cannot be read nothing is processed and the answer is 503 idempotency_unavailable: retry with the same key.

Match^[A-Za-z0-9_-]{8,128}$

Request Body

application/json
  1. body
supplierId?string
supplierName?string
Lengthlength <= 120
lines*array<>
Items1 <= items <= 50
expectedAt?integer

Epoch milliseconds.

note?string
Lengthlength <= 500

Response Body

Created

application/json
  1. response
data*
Example Request
curl -X POST 'https://api.shopeazy.co/v1/merchant/stores/<storeId>/purchase-orders' \  -H 'Authorization: Bearer <access_token>' \  -H 'Idempotency-Key: <unique_key>' \  -H 'Content-Type: application/json' \  -d '{  "lines": [    {      "name": "string",      "quantity": 1    }  ]}'
Example Response
{  "data": {    "id": "string",    "number": "string",    "supplierId": "string",    "supplierName": "string",    "status": "draft",    "lines": [      {        "id": "string",        "materialId": "string",        "itemId": "string",        "variantId": "string",        "name": "string",        "quantity": 0,        "received": 0,        "unit": "each",        "unitCost": null      }    ],    "total": {      "amount": 0,      "currency": "ZAR"    },    "expectedAt": 0,    "sentAt": 0,    "receivedAt": 0,    "note": "string"  }}

Supplier orders, newest first GET

Status, lines and what has arrived. Access: OAuth scope `listings:read`; not write-gated. Paged: `{ items, nextCursor }`, `limit` (default 30, at most 100) and an opaque `cursor`. It pages through the newest 100.

Mark a supplier order sent or cancelled PUT

Setting the state it is already in changes nothing. Access: OAuth scope `listings:write`; write-gated by the subscription.