> ## Documentation Index > Fetch the complete documentation index at: https://docs.arcuserp.com/llms.txt > Use this file to discover all available pages before exploring further. # Pack an order with PackPilot (Arcus auto-pack) > **Rule 25 dual-dispatch fix (2026-05-29):** This endpoint was previously only accessible via Cognito-JWT (`/fulfillment/pack-order`); API-key callers received 404. `packOrderV1` is now wired in `routes/api-v1/fulfillment.mjs` per Rule 25. Runs the PackPilot 3D bin-packing algorithm against an unpacked (or partially packed) order. Creates one or more `Package` objects optimally sized to the entity's active box inventory, allocates inventory, and (if configured) auto-rates and auto-buys Shippo labels in the same call. **Authorization:** requires `fulfillment:write` API-key scope AND the per-user `fulfillment.pack` permission (SoD assertion inside canonical handler). **Layer 1:** `entity_id` is always derived from the API key; any `entity_id` in the request body is silently overwritten. **THE ONE RULE:** delegates to the canonical `packOrder` handler in `routes/fulfillment.mjs`. All PackPilot logic (bin-packing, location-shortfall guard, label auto-buy, leftover persistence, incident-id error correlation) lives in the canonical handler; bug fixes propagate automatically. **Idempotency:** idempotent per `Idempotency-Key` header. If the order is already fully packed, returns `409 all_items_already_packed`. **Key request body fields:** - `order_id` (required, UUID): the order to pack - `auto_rate` (boolean, optional): fetch Shippo rates for each created package - `auto_buy_label` (boolean, optional): purchase Shippo label for each package (requires `auto_rate: true` and a configured shipping rule) **Blocker codes (422):** - `location_shortfall_blocks_pack`: all packable lines are out of stock at the order's location. Response includes `short_lines[]` with cross-location stock. - `ship_complete_blocked`: `ship_complete=true` and one or more lines have insufficient inventory to fully pack. - `packpilot_no_boxes`: no active box products are configured for this entity. - `packpilot_circuit_open`: PackPilot Lambda is unavailable; use Manual Pack. - `packpilot_item_too_large`: at least one line item exceeds the largest box. - `repack_blocked_label_void_failed`: a repack was attempted but an existing Shippo label could not be voided; resolve carrier-side before repacking. ## OpenAPI ````yaml /openapi.yaml post /fulfillment/pack-order openapi: 3.1.0 info: title: Arcus ERP Public API version: 1.0.0 description: > Arcus ERP public REST API. Designed for external integrations and data migration. **Authentication.** Bearer token (API key) via the `Authorization` header. Format: `Authorization: Bearer ark_live_ent__` (or `ark_test_*` for sandbox). API keys are issued per-entity in **Settings > Developers > API Keys**. **Entity scoping.** The entity is encoded in the API key prefix; routes are flat (e.g. `/v1/accounts`, `/v1/orders`, `/v1/products`). A small set of platform endpoints (migration, reconciliation, events, webhook endpoints, API keys) use the `/v1/entities/{entity_id}/...` form -- those are noted in their tags. **Key capabilities.** - Related-resource hydration via `?expand[]=` (see `x-arcus-expand` on each resource). - Cursor-based pagination (`starting_after` / `ending_before` / `limit`). - Idempotency via the `Idempotency-Key` header. - Webhook events for asynchronous notification. - Conditional requests / ETag for cache validation. servers: - url: https://api.arcuserp.com/v1 description: Arcus ERP API (accepts both live `ark_live_*` and test `ark_test_*` keys) - url: https://dev-api.arcuserp.com/v1 description: >- Dev sandbox API (test-only data, accepts `ark_test_*` keys against dev RDS) security: [] paths: /fulfillment/pack-order: post: tags: - Fulfillment summary: Pack an order with PackPilot (Arcus auto-pack) description: > **Rule 25 dual-dispatch fix (2026-05-29):** This endpoint was previously only accessible via Cognito-JWT (`/fulfillment/pack-order`); API-key callers received 404. `packOrderV1` is now wired in `routes/api-v1/fulfillment.mjs` per Rule 25. Runs the PackPilot 3D bin-packing algorithm against an unpacked (or partially packed) order. Creates one or more `Package` objects optimally sized to the entity's active box inventory, allocates inventory, and (if configured) auto-rates and auto-buys Shippo labels in the same call. **Authorization:** requires `fulfillment:write` API-key scope AND the per-user `fulfillment.pack` permission (SoD assertion inside canonical handler). **Layer 1:** `entity_id` is always derived from the API key; any `entity_id` in the request body is silently overwritten. **THE ONE RULE:** delegates to the canonical `packOrder` handler in `routes/fulfillment.mjs`. All PackPilot logic (bin-packing, location-shortfall guard, label auto-buy, leftover persistence, incident-id error correlation) lives in the canonical handler; bug fixes propagate automatically. **Idempotency:** idempotent per `Idempotency-Key` header. If the order is already fully packed, returns `409 all_items_already_packed`. **Key request body fields:** - `order_id` (required, UUID): the order to pack - `auto_rate` (boolean, optional): fetch Shippo rates for each created package - `auto_buy_label` (boolean, optional): purchase Shippo label for each package (requires `auto_rate: true` and a configured shipping rule) **Blocker codes (422):** - `location_shortfall_blocks_pack`: all packable lines are out of stock at the order's location. Response includes `short_lines[]` with cross-location stock. - `ship_complete_blocked`: `ship_complete=true` and one or more lines have insufficient inventory to fully pack. - `packpilot_no_boxes`: no active box products are configured for this entity. - `packpilot_circuit_open`: PackPilot Lambda is unavailable; use Manual Pack. - `packpilot_item_too_large`: at least one line item exceeds the largest box. - `repack_blocked_label_void_failed`: a repack was attempted but an existing Shippo label could not be voided; resolve carrier-side before repacking. operationId: packOrder parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object required: - order_id properties: order_id: type: string format: uuid description: >- The order to pack. Must be confirmed, not yet fully fulfilled. auto_rate: type: boolean description: >- Fetch Shippo carrier rates for each created package immediately after packing. auto_buy_label: type: boolean description: > Purchase a Shippo label for each package using the best matching shipping rule. Requires `auto_rate: true`. If label purchase fails for a package, the error is returned in `package_auto_labels[pkg_id].error` (non-fatal). responses: '200': description: Order packed successfully. content: application/json: schema: type: object properties: data: type: object properties: packages: type: array description: Newly created package objects. items: $ref: '#/components/schemas/Package' leftovers: type: array description: > Line items that could not be packed (insufficient inventory, item too large, or kit component imbalance). Each leftover is persisted to `fulfillment.pack_leftovers` for later resolution. items: type: object properties: order_item_id: type: string format: uuid sku: type: string product_name: type: string remaining_qty: type: integer reason: type: string shipping_score: type: number description: PackPilot's packing efficiency score (0-100). box_count: type: integer description: Number of packages created. auto_rate_on_pack: type: boolean description: Whether Shippo rates were fetched for each package. auto_buy_label_on_pack: type: boolean description: Whether labels were auto-purchased for each package. package_rates: type: object description: > Present when `auto_rate_on_pack=true`. Keyed by package_id. Each value is `{ rates: ShippoRate[] }` or `{ error: string }`. package_auto_labels: type: object description: > Present when `auto_buy_label_on_pack=true`. Keyed by package_id. Each value is `{ label_id, tracking_number, carrier, service_name, amount }` or `{ error: string }` if the label purchase failed for that package. '400': $ref: '#/components/responses/Error' '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '404': $ref: '#/components/responses/Error' '409': description: > Idempotency conflict: `all_items_already_packed` -- the order has already been fully packed. No action was taken. content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: > Packing blocked. Body contains `code` with one of: `location_shortfall_blocks_pack`, `ship_complete_blocked`, `packpilot_no_boxes`, `packpilot_circuit_open`, `packpilot_item_too_large`, `repack_blocked_label_void_failed`. content: application/json: schema: $ref: '#/components/schemas/Error' security: - ApiKeyAuth: [] components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: | Client-generated unique key for idempotent POST/PATCH/DELETE operations. Alias for the Idempotency parameter. Max 255 chars. On retry with the same key, the original response is returned without re-executing the operation. Keys expire after 24 hours. schema: type: string maxLength: 255 schemas: Package: type: object description: | A shipment / box created during fulfillment. One package contains many package items (line item splits) and at most one shipment label. properties: id: type: string format: uuid object: type: string enum: - package entity_id: type: string format: uuid readOnly: true order_id: type: string format: uuid package_number: type: string readOnly: true description: Sequential per entity. status: type: string enum: - packing - packed - labeled - shipped - delivered - returned - void readOnly: true weight_lb: type: number nullable: true length_in: type: number nullable: true width_in: type: number nullable: true height_in: type: number nullable: true carrier: type: string nullable: true description: e.g. ups, usps, fedex, dhl. service_level: type: string nullable: true description: e.g. ground, priority, 2day. tracking_number: type: string nullable: true tracking_url: type: string nullable: true ship_cost: type: number nullable: true billed_ship_cost: type: number nullable: true description: Cost billed to customer (vs purchased cost). location_id: type: string format: uuid nullable: true insurance_amount_override: type: number nullable: true description: > Manual override of the auto-computed Shippo-insurance declared value. When set, overrides the value derived from products flagged apply_freight_insurance. insurance: type: object nullable: true readOnly: true description: > Auto-insurance summary. `null` when no package item opts in and there is no override / entity threshold. `bought: true` after a label has been purchased (amount = the value actually insured at Shippo); `bought: false` projects what the next label purchase will insure. properties: active: type: boolean bought: type: boolean amount: type: number description: Insured declared value (USD). currency: type: string fee_estimate: type: number description: ~1.5% of declared value; the exact fee is in the rate. provider: type: string nullable: true description: UPS | USPS | FEDEX | DHL once the carrier is chosen. covered_items: type: array items: type: string covered_item_count: type: integer source: type: string enum: - product_toggle - entity_threshold - manual_override shipped_at: type: string format: date-time nullable: true readOnly: true delivered_at: type: string format: date-time nullable: true readOnly: true metadata: type: object nullable: true created_at: type: string format: date-time readOnly: true updated_at: type: string format: date-time readOnly: true Error: description: | Alias for ErrorEnvelope. Canonical error response shape used by all API endpoints. Refer to ErrorEnvelope for the full field definition. allOf: - $ref: '#/components/schemas/ErrorEnvelope' ErrorEnvelope: type: object description: | Canonical error response envelope. All API errors use this shape. required: - error - code properties: error: type: string description: Machine-readable error key example: not_found code: type: string description: Machine-readable error code (often same as error) example: not_found type: type: string enum: - validation_error - permission_error - not_found - conflict - rate_limit - internal - expand_error - not_implemented example: not_found hint: type: string description: Human-readable one-sentence explanation (English) example: >- The requested order does not exist or does not belong to this entity. param: type: string description: The parameter that caused the error, if applicable example: expand[0] required: type: string description: The scope required (only on insufficient_scope errors) example: accounts:read request_id: type: string description: >- Unique request ID for support tracing (maps to CloudWatch log stream) example: req_abc123 responses: Error: description: Error response (400/401/403/404/409/422/429/500) content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' securitySchemes: ApiKeyAuth: type: http scheme: bearer description: | API key issued per entity via Settings > Developers > API Keys. Each key carries scopes (e.g. orders:read, products:write). Bearer token format: Authorization: Bearer ark_live_ent__ Test keys use ark_test_ent__. Both are issued per entity via Settings > Developers > API Keys. ````