> ## Documentation Index > Fetch the complete documentation index at: https://docs.arcuserp.com/llms.txt > Use this file to discover all available pages before exploring further. # Change the ship-to address on an order after labels are purchased > Destructive Change-Ship-To wizard execute. The everyday PATCH path (`PATCH /v1/orders/{id}`) refuses to mutate `shipping_address_id` while active Shippo labels exist (the post-label silent-misship hard block). This endpoint is the CS Lead override that orchestrates the full void-then-repurchase flow in one transactional sweep: 1. Asserts `orders.override_post_label_edit` (server-side; equivalent to the public-API destructive scope combination below). 2. Resolves the new address: either existing `new_address_id` OR creates a new `account_addresses` row from `new_address_payload` via the canonical addAddress() helper (Triple-lock validation Shippo USPS CASS + AvaTax fires inline). 3. For every active label on the order, voids via the canonical `voidLabel` handler (Shippo refund API + GL reversal of the freight JE keyed `label:` + residential-surcharge reversal if last active label + activity log). 4. Atomically updates `orders.shipping_address_id` (and optionally `billing_address_id` if `also_change_billing=true`). 5. Calls `recalculateTaxForOrder` against the new destination (AvaTax re-finalization). 6. Per `repurchase_strategy`: auto-buys the cheapest new label per package (`auto_cheapest`), returns the rate set for the operator to choose (`manual`), or skips repurchase entirely (`defer`). 7. For every new label, calls the canonical `createShippingDeltaCharge` helper to bill/refund the customer for the rate delta vs original (idempotent on label_id). 8. Logs ONE structured `ORDER_SHIP_TO_CHANGED_VIA_WIZARD` activity row with full metadata, and broadcasts `order.ship_to_changed`. **Both `confirm_void_labels=true` AND `confirm_repurchase_labels=true` are required** (unless `repurchase_strategy=defer`, which only needs `confirm_void_labels=true`). This is the two-key safety gate equivalent of the wizard's review-confirm step in the UI. **Partial failure semantics:** if any label refuses to void (e.g. carrier-scanned, in-transit), the orders row is NOT updated. Response returns `422 partial_void_failure` with the list of labels that did void + the offender so the operator can route to carrier Package Intercept. **Scopes:** `orders:write` AND `fulfillment:write` both required. **Idempotency:** `Idempotency-Key` header is supported; repeat submissions return the original response without re-charging. Filed by NEW-GAP-CS-ADDRESS-CHANGE-POST-LABEL-PURCHASE + NEW-GAP- CHANGE-SHIP-TO-WIZARD-VOID-AND-REPURCHASE (2026-05-16). **Industry parallel:** Shopify Edit Order (void + reissue); NetSuite Reverse Fulfillment + Re-fulfill; Acumatica Cancel Shipment + Reissue. ## OpenAPI ````yaml /openapi.yaml post /orders/{id}/change-ship-to openapi: 3.1.0 info: title: Arcus ERP Public API version: 1.0.0 description: > Arcus ERP public REST API. Designed for external integrations and data migration. **Authentication.** Bearer token (API key) via the `Authorization` header. Format: `Authorization: Bearer ark_live_ent__` (or `ark_test_*` for sandbox). API keys are issued per-entity in **Settings > Developers > API Keys**. **Entity scoping.** The entity is encoded in the API key prefix; routes are flat (e.g. `/v1/accounts`, `/v1/orders`, `/v1/products`). A small set of platform endpoints (migration, reconciliation, events, webhook endpoints, API keys) use the `/v1/entities/{entity_id}/...` form -- those are noted in their tags. **Key capabilities.** - Related-resource hydration via `?expand[]=` (see `x-arcus-expand` on each resource). - Cursor-based pagination (`starting_after` / `ending_before` / `limit`). - Idempotency via the `Idempotency-Key` header. - Webhook events for asynchronous notification. - Conditional requests / ETag for cache validation. servers: - url: https://api.arcuserp.com/v1 description: Arcus ERP API (accepts both live `ark_live_*` and test `ark_test_*` keys) - url: https://dev-api.arcuserp.com/v1 description: >- Dev sandbox API (test-only data, accepts `ark_test_*` keys against dev RDS) security: [] paths: /orders/{id}/change-ship-to: parameters: - name: id in: path required: true schema: type: string format: uuid description: UUID of the order to change ship-to for. post: tags: - Orders summary: Change the ship-to address on an order after labels are purchased description: | Destructive Change-Ship-To wizard execute. The everyday PATCH path (`PATCH /v1/orders/{id}`) refuses to mutate `shipping_address_id` while active Shippo labels exist (the post-label silent-misship hard block). This endpoint is the CS Lead override that orchestrates the full void-then-repurchase flow in one transactional sweep: 1. Asserts `orders.override_post_label_edit` (server-side; equivalent to the public-API destructive scope combination below). 2. Resolves the new address: either existing `new_address_id` OR creates a new `account_addresses` row from `new_address_payload` via the canonical addAddress() helper (Triple-lock validation Shippo USPS CASS + AvaTax fires inline). 3. For every active label on the order, voids via the canonical `voidLabel` handler (Shippo refund API + GL reversal of the freight JE keyed `label:` + residential-surcharge reversal if last active label + activity log). 4. Atomically updates `orders.shipping_address_id` (and optionally `billing_address_id` if `also_change_billing=true`). 5. Calls `recalculateTaxForOrder` against the new destination (AvaTax re-finalization). 6. Per `repurchase_strategy`: auto-buys the cheapest new label per package (`auto_cheapest`), returns the rate set for the operator to choose (`manual`), or skips repurchase entirely (`defer`). 7. For every new label, calls the canonical `createShippingDeltaCharge` helper to bill/refund the customer for the rate delta vs original (idempotent on label_id). 8. Logs ONE structured `ORDER_SHIP_TO_CHANGED_VIA_WIZARD` activity row with full metadata, and broadcasts `order.ship_to_changed`. **Both `confirm_void_labels=true` AND `confirm_repurchase_labels=true` are required** (unless `repurchase_strategy=defer`, which only needs `confirm_void_labels=true`). This is the two-key safety gate equivalent of the wizard's review-confirm step in the UI. **Partial failure semantics:** if any label refuses to void (e.g. carrier-scanned, in-transit), the orders row is NOT updated. Response returns `422 partial_void_failure` with the list of labels that did void + the offender so the operator can route to carrier Package Intercept. **Scopes:** `orders:write` AND `fulfillment:write` both required. **Idempotency:** `Idempotency-Key` header is supported; repeat submissions return the original response without re-charging. Filed by NEW-GAP-CS-ADDRESS-CHANGE-POST-LABEL-PURCHASE + NEW-GAP- CHANGE-SHIP-TO-WIZARD-VOID-AND-REPURCHASE (2026-05-16). **Industry parallel:** Shopify Edit Order (void + reissue); NetSuite Reverse Fulfillment + Re-fulfill; Acumatica Cancel Shipment + Reissue. operationId: changeOrderShipTo parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object properties: new_address_id: type: string format: uuid description: >- Existing account_addresses.id (mutually exclusive with new_address_payload). new_address_payload: type: object description: >- Raw address payload; creates a new account_addresses row via the canonical addAddress helper. properties: line1: type: string line2: type: string nullable: true city: type: string state: type: string zip: type: string country: type: string default: US name: type: string nullable: true label: type: string nullable: true is_commercial: type: boolean default: false also_change_billing: type: boolean default: false description: Also copy the new address into billing_address_id. confirm_void_labels: type: boolean description: >- REQUIRED. Two-key safety gate; must be true to authorize label void. confirm_repurchase_labels: type: boolean description: REQUIRED unless repurchase_strategy=defer. repurchase_strategy: type: string enum: - auto_cheapest - manual - defer default: auto_cheapest description: >- auto_cheapest = auto-buy cheapest new label per package; manual = return rates and let operator choose; defer = leave packages unlabeled for the warehouse. payment_method_id: type: string format: uuid nullable: true description: Optional Stripe payment_method to bill the rate delta. user_id: type: string format: uuid nullable: true description: Audit attribution; defaults to API key owner if omitted. reason: type: string nullable: true description: Operator note for the audit log. required: - confirm_void_labels example: new_address_id: aa11bb22-cc33-dd44-ee55-ff6677889900 also_change_billing: false confirm_void_labels: true confirm_repurchase_labels: true repurchase_strategy: auto_cheapest reason: Customer corrected ZIP; was 90210, should be 92010. responses: '200': description: >- Ship-to changed successfully (may include partial purchase_failures with HTTP 200 when at least one new label posted). content: application/json: schema: type: object properties: data: type: object properties: order_id: type: string format: uuid order_number: type: string old_shipping_address_id: type: string format: uuid nullable: true new_shipping_address_id: type: string format: uuid new_shipping_address: type: object voided_labels: type: array items: type: object new_labels: type: array items: type: object rate_deltas: type: array items: type: object charge_results: type: array items: type: object purchase_failures: type: array items: type: object repurchase_strategy: type: string '400': $ref: '#/components/responses/Error' '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '404': $ref: '#/components/responses/Error' '422': $ref: '#/components/responses/Error' security: - ApiKeyAuth: [] components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: | Client-generated unique key for idempotent POST/PATCH/DELETE operations. Alias for the Idempotency parameter. Max 255 chars. On retry with the same key, the original response is returned without re-executing the operation. Keys expire after 24 hours. schema: type: string maxLength: 255 responses: Error: description: Error response (400/401/403/404/409/422/429/500) content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' schemas: ErrorEnvelope: type: object description: | Canonical error response envelope. All API errors use this shape. required: - error - code properties: error: type: string description: Machine-readable error key example: not_found code: type: string description: Machine-readable error code (often same as error) example: not_found type: type: string enum: - validation_error - permission_error - not_found - conflict - rate_limit - internal - expand_error - not_implemented example: not_found hint: type: string description: Human-readable one-sentence explanation (English) example: >- The requested order does not exist or does not belong to this entity. param: type: string description: The parameter that caused the error, if applicable example: expand[0] required: type: string description: The scope required (only on insufficient_scope errors) example: accounts:read request_id: type: string description: >- Unique request ID for support tracing (maps to CloudWatch log stream) example: req_abc123 securitySchemes: ApiKeyAuth: type: http scheme: bearer description: | API key issued per entity via Settings > Developers > API Keys. Each key carries scopes (e.g. orders:read, products:write). Bearer token format: Authorization: Bearer ark_live_ent__ Test keys use ark_test_ent__. Both are issued per entity via Settings > Developers > API Keys. ````