> ## Documentation Index > Fetch the complete documentation index at: https://docs.arcuserp.com/llms.txt > Use this file to discover all available pages before exploring further. # Update an account > Updates the allowlisted fields on an account; credit balance, credit hold, merge fields, and the analytics columns cannot be set here and return 422 `forbidden_field`, with dedicated endpoints for credit hold and merge instead. Changing `tax_exempt` or `avatax_entity_code` triggers an automatic AvaTax recalculation, and Shopify customer sync fires afterward when enabled. ## OpenAPI ````yaml /openapi.yaml patch /accounts/{id} openapi: 3.1.0 info: title: Arcus ERP Public API version: 1.0.0 description: > Arcus ERP public REST API. Designed for external integrations and data migration. **Authentication.** Bearer token (API key) via the `Authorization` header. Format: `Authorization: Bearer ark_live_ent__` (or `ark_test_*` for sandbox). API keys are issued per-entity in **Settings > Developers > API Keys**. **Entity scoping.** The entity is encoded in the API key prefix; routes are flat (e.g. `/v1/accounts`, `/v1/orders`, `/v1/products`). A small set of platform endpoints (migration, reconciliation, events, webhook endpoints, API keys) use the `/v1/entities/{entity_id}/...` form -- those are noted in their tags. **Key capabilities.** - Related-resource hydration via `?expand[]=` (see `x-arcus-expand` on each resource). - Cursor-based pagination (`starting_after` / `ending_before` / `limit`). - Idempotency via the `Idempotency-Key` header. - Webhook events for asynchronous notification. - Conditional requests / ETag for cache validation. **Changelog.** Entries are dated and name every published contract whose MEANING moved, not only the ones whose field names changed. The narrative version of the same entries, written for integrators, is published at https://arcuserp.mintlify.app/changelog. **2026-09-22 (planned 2026-09-21), REORDER-BUYER-TRUTH: demand changed what it MEANS on three published contracts, with no field renamed.** An integrator that pins field names sees no breakage and different numbers, which is why this entry exists. - **Demand now counts build consumption.** `demand_avg_per_day` on the public product, kit and inventory-balance objects, and `daily_demand` / `demand_basis` / `net_suggested_qty` on `GET /v1/purchasing/reorder-report`, are composed from fulfilled sales lines PLUS posted `build_consume` inventory draws: each physical decrement of a product counts exactly once. The previous rule adopted an internal-consumption basis only when the sales blend was exactly zero, so a product both sold AND consumed into work orders planned as if the build draws did not exist. Products drawn into work orders move; on one production-shaped dataset five did, the largest from 0.05/day to 14.95/day. - **`demand_basis` now carries four values, not two:** `sales`, `sales_and_builds`, `builds` and `consumption`. A consumer with a two-branch reader (anything that is not `consumption` is `sales`) silently hides the two new ones. - **`current_demand_units` on `GET /v1/inventory/balances/:id` moved, by a second rule.** It counts committed-but-unshipped CUSTOMER demand, and it now counts a kit component's own line rather than its parent kit line, and excludes non-sales documents. On one production dataset 269 of 1,043 balance rows changed, 227 of them downward; the largest single move was 1,941 to 25, on a product whose open PURCHASE order line had been reported as customer demand. Re-baseline anything that alerts or reorders off this field. - `run_rate_30/90/180/365` and `blended_daily` on the same balance object move for the first reason above. - **Added, not changed:** `GET /v1/purchasing/reorder-report` accepts `demand_window` and returns the unit, cover-through and reorder-point-provenance fields documented on that operation; `order_multiple` is accepted and returned on the product-vendor doors. - **Volume note.** The `inventory.low_stock`, `inventory.out_of_stock` and `inventory.back_in_stock` webhook events are population-gated on `on_hand <= reorder_point`, and reorder points move with the demand above, so subscribers should expect a one-time step change in event volume around the release. servers: - url: https://api.arcuserp.com/v1 description: Arcus ERP API (accepts both live `ark_live_*` and test `ark_test_*` keys) - url: https://dev-api.arcuserp.com/v1 description: >- Dev sandbox API (test-only data, accepts `ark_test_*` keys against dev RDS) security: [] paths: /accounts/{id}: parameters: - name: id in: path required: true schema: type: string description: > Account UUID or account_number (e.g. ACCT-001, CUST-00042). Polymorphic lookup: if the value is not a UUID it is resolved to a UUID via accounts.account_number within the entity scope before the record is fetched. (NEW-GAP-API-V1-POLYMORPHIC-LOOKUP-CROSS-RESOURCE 2026-05-20) patch: tags: - Accounts summary: Update an account description: >- Updates the allowlisted fields on an account; credit balance, credit hold, merge fields, and the analytics columns cannot be set here and return 422 `forbidden_field`, with dedicated endpoints for credit hold and merge instead. Changing `tax_exempt` or `avatax_entity_code` triggers an automatic AvaTax recalculation, and Shopify customer sync fires afterward when enabled. operationId: updateAccount requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AccountPatch' responses: '200': description: Updated account object content: application/json: schema: type: object properties: data: $ref: '#/components/schemas/Account' '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '404': $ref: '#/components/responses/Error' '422': description: Forbidden field or validation error content: application/json: schema: type: object properties: error: type: string enum: - forbidden_field - tax_exempt_requires_exemption_code code: type: string param: type: string description: The forbidden field name (when error=forbidden_field). security: - ApiKeyAuth: - accounts:write components: schemas: AccountPatch: type: object description: > Partial-update payload for an account. Only present fields are applied; omit a field to leave it unchanged. `entity_id`, `id`, `account_number`, `credit_balance`, `is_credit_hold`, and `stripe_customer_id` are read-only. properties: display_name: type: string company_name: type: string nullable: true email: type: string nullable: true phone_main: type: string nullable: true phone_secondary: type: string nullable: true phone_mobile: type: string nullable: true website: type: string nullable: true payment_term_id: type: string format: uuid nullable: true credit_limit: type: number nullable: true tax_exempt: type: boolean avatax_entity_code: type: string nullable: true tax_number: type: string nullable: true default_pricing_level_id: type: string format: uuid nullable: true default_location_id: type: string format: uuid nullable: true default_shipping_method: type: string nullable: true shipping_preference: type: string enum: - always_freight - always_parcel - auto nullable: true enable_pro_portal: type: boolean is_active: type: boolean notes: type: string nullable: true metadata: type: object nullable: true external_customer_id: type: string nullable: true Account: type: object description: > An Arcus ERP account. Represents a customer, vendor, lead, or individual. account_type drives AR vs AP behavior: business/individual/lead = customer (AR); vendor = supplier (AP). entity_id is always from the API key (Layer 1 isolation). properties: id: type: string format: uuid object: type: string enum: - account entity_id: type: string format: uuid readOnly: true display_name: type: string description: UI-facing name. Required. company_name: type: string nullable: true account_type: type: string enum: - business - individual - lead - vendor description: business/individual/lead = customer (AR); vendor = supplier (AP). account_number: type: string nullable: true readOnly: true description: Auto-generated sequential number within entity. Unique per entity. email: type: string nullable: true phone_main: type: string nullable: true phone_secondary: type: string nullable: true phone_mobile: type: string nullable: true website: type: string nullable: true payment_term_id: type: string format: uuid nullable: true credit_limit: type: number nullable: true credit_balance: type: number readOnly: true description: 'SSOT: utils/ar-helpers.mjs. Do not write directly.' is_credit_hold: type: boolean readOnly: true description: | Read-only on PATCH /accounts/{id} (Rule 23 SSOT). To set or clear the credit hold use the dedicated action endpoint POST /accounts/{id}/credit-hold { on_hold: bool, reason?: string }. The action endpoint delegates to canonical utils/credit-hold-helpers.mjs::setCreditHold which is the SOLE writer and also cascades to orders.is_credit_hold_blocked. tax_exempt: type: boolean avatax_entity_code: type: string nullable: true tax_number: type: string nullable: true default_pricing_level_id: type: string format: uuid nullable: true default_location_id: type: string format: uuid nullable: true default_shipping_method: type: string nullable: true shipping_preference: type: string enum: - always_freight - always_parcel - auto nullable: true enable_pro_portal: type: boolean is_active: type: boolean notes: type: string nullable: true metadata: type: object nullable: true stripe_customer_id: type: string nullable: true readOnly: true source_platform: type: string nullable: true readOnly: true external_customer_id: type: string nullable: true created_at: type: string format: date-time readOnly: true updated_at: type: string format: date-time readOnly: true ErrorEnvelope: type: object description: | Canonical error response envelope. All API errors use this shape. required: - error - code properties: error: type: string description: Machine-readable error key example: not_found code: type: string description: Machine-readable error code (often same as error) example: not_found type: type: string enum: - validation_error - permission_error - not_found - conflict - rate_limit - internal - expand_error - not_implemented example: not_found hint: type: string description: Human-readable one-sentence explanation (English) example: >- The requested order does not exist or does not belong to this entity. param: type: string description: The parameter that caused the error, if applicable example: expand[0] required: type: string description: The scope required (only on insufficient_scope errors) example: accounts:read request_id: type: string description: >- Unique request ID for support tracing (maps to CloudWatch log stream) example: req_abc123 responses: Error: description: Error response (400/401/403/404/409/422/429/500) content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' securitySchemes: ApiKeyAuth: type: http scheme: bearer description: | API key issued per entity via Settings > Developers > API Keys. Each key carries scopes (e.g. orders:read, products:write). Bearer token format: Authorization: Bearer ark_live_ent__ Test keys use ark_test_ent__. Both are issued per entity via Settings > Developers > API Keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.