> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arcuserp.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Purchase a Shippo shipping label for this package
> Required API key scope: `fulfillment:write`
Delegates to purchaseLabel in routes/shipping.mjs via buyLabelForPackage
canonical helper. Requires a configured Shippo connector for the entity.
The purchased label URL and tracking number are saved to
fulfillment.package_shipment_labels. Idempotent via Idempotency-Key.
## OpenAPI
````yaml /openapi.yaml post /packages/{id}/buy-label
openapi: 3.1.0
info:
title: Arcus ERP Public API
version: 1.0.0
description: >
Arcus ERP public REST API. Designed for external integrations and data
migration.
**Authentication.** Bearer token (API key) via the `Authorization` header.
Format: `Authorization: Bearer ark_live_ent__` (or
`ark_test_*` for sandbox).
API keys are issued per-entity in **Settings > Developers > API Keys**.
**Entity scoping.** The entity is encoded in the API key prefix; routes are
flat
(e.g. `/v1/accounts`, `/v1/orders`, `/v1/products`). A small set of platform
endpoints
(migration, reconciliation, events, webhook endpoints, API keys) use the
`/v1/entities/{entity_id}/...` form -- those are noted in their tags.
**Key capabilities.**
- Related-resource hydration via `?expand[]=` (see `x-arcus-expand` on each resource).
- Cursor-based pagination (`starting_after` / `ending_before` / `limit`).
- Idempotency via the `Idempotency-Key` header.
- Webhook events for asynchronous notification.
- Conditional requests / ETag for cache validation.
servers:
- url: https://api.arcuserp.com/v1
description: Arcus ERP API (accepts both live `ark_live_*` and test `ark_test_*` keys)
- url: https://dev-api.arcuserp.com/v1
description: >-
Dev sandbox API (test-only data, accepts `ark_test_*` keys against dev
RDS)
security: []
paths:
/packages/{id}/buy-label:
parameters:
- name: id
in: path
required: true
schema:
type: string
format: uuid
post:
tags:
- Fulfillment
summary: Purchase a Shippo shipping label for this package
description: |
Required API key scope: `fulfillment:write`
Delegates to purchaseLabel in routes/shipping.mjs via buyLabelForPackage
canonical helper. Requires a configured Shippo connector for the entity.
The purchased label URL and tracking number are saved to
fulfillment.package_shipment_labels. Idempotent via Idempotency-Key.
operationId: buyPackageLabel
parameters:
- $ref: '#/components/parameters/IdempotencyKey'
requestBody:
content:
application/json:
schema:
type: object
properties:
rate_object_id:
type: string
carrier:
type: string
service_token:
type: string
service_name:
type: string
shipment_object_id:
type: string
parcel_object_id:
type: string
estimated_amount:
type: number
label_file_type:
type: string
enum:
- PDF
- ZPLII
- PNG
default: PDF
responses:
'200':
description: >
Purchased label record.
NEW-GAP-RERATE-SHIPPING-CHARGE-DELTA-WORKFLOW
(2026-05-16): the response now includes a `shipping_cost_analysis`
block when the carrier cost diverges from what the customer was
charged for shipping. When `suggest_action !== 'absorb'`, the
operator (or a downstream automation) should call
`POST /packages/{id}/recharge-label` to settle the delta.
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/PackageLabel'
- type: object
properties:
shipping_cost_analysis:
nullable: true
type: object
description: |
Carrier-cost-vs-customer-charged delta. Null when
the analysis could not be computed (logged
server-side as a non-blocking warning).
properties:
customer_charged:
type: number
description: orders.shipping_total at time of label purchase
carrier_cost:
type: number
description: just-purchased label actual_amount
delta:
type: number
description: |
carrier_cost - customer_charged. Positive means
Arcus is absorbing cost (upgrade case); negative
means customer overpaid.
suggest_action:
type: string
enum:
- recharge
- refund_overpay
- absorb
description: |
recharge -- delta > threshold; bill the customer
refund_overpay -- delta < -threshold; refund
absorb -- |delta| <= threshold; no operator action
threshold:
type: number
description: per-entity setting, default $2
label_id:
type: string
format: uuid
nullable: true
package_id:
type: string
format: uuid
nullable: true
order_id:
type: string
format: uuid
nullable: true
'400':
$ref: '#/components/responses/Error'
'401':
$ref: '#/components/responses/Error'
'403':
$ref: '#/components/responses/Error'
'404':
$ref: '#/components/responses/Error'
'422':
$ref: '#/components/responses/Error'
security:
- ApiKeyAuth: []
components:
parameters:
IdempotencyKey:
name: Idempotency-Key
in: header
required: false
description: |
Client-generated unique key for idempotent POST/PATCH/DELETE operations.
Alias for the Idempotency parameter. Max 255 chars. On retry with the
same key, the original response is returned without re-executing the
operation. Keys expire after 24 hours.
schema:
type: string
maxLength: 255
schemas:
PackageLabel:
type: object
description: >
A shipping label purchased from a carrier (typically Shippo). One label
per package.
URLs expire 30 days after purchase; persist the PDF locally for
long-term retention.
properties:
id:
type: string
format: uuid
package_id:
type: string
format: uuid
carrier:
type: string
service_level:
type: string
tracking_number:
type: string
label_url:
type: string
description: Carrier-hosted PDF URL (time-limited).
label_pdf_url:
type: string
nullable: true
description: Arcus-archived PDF URL (permanent).
purchased_cost:
type: number
description: Amount Arcus paid the carrier.
billed_cost:
type: number
nullable: true
description: Amount billed to the customer.
purchased_at:
type: string
format: date-time
readOnly: true
voided_at:
type: string
format: date-time
nullable: true
readOnly: true
ErrorEnvelope:
type: object
description: |
Canonical error response envelope. All API errors use this shape.
required:
- error
- code
properties:
error:
type: string
description: Machine-readable error key
example: not_found
code:
type: string
description: Machine-readable error code (often same as error)
example: not_found
type:
type: string
enum:
- validation_error
- permission_error
- not_found
- conflict
- rate_limit
- internal
- expand_error
- not_implemented
example: not_found
hint:
type: string
description: Human-readable one-sentence explanation (English)
example: >-
The requested order does not exist or does not belong to this
entity.
param:
type: string
description: The parameter that caused the error, if applicable
example: expand[0]
required:
type: string
description: The scope required (only on insufficient_scope errors)
example: accounts:read
request_id:
type: string
description: >-
Unique request ID for support tracing (maps to CloudWatch log
stream)
example: req_abc123
responses:
Error:
description: Error response (400/401/403/404/409/422/429/500)
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
securitySchemes:
ApiKeyAuth:
type: http
scheme: bearer
description: |
API key issued per entity via Settings > Developers > API Keys.
Each key carries scopes (e.g. orders:read, products:write).
Bearer token format: Authorization: Bearer ark_live_ent__
Test keys use ark_test_ent__. Both are issued per entity
via Settings > Developers > API Keys.
````