> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arcuserp.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Create a purchase order
> Required API key scope: `purchasing:write`
Creates a new purchase order in `draft` status. You must identify the vendor
using either `vendor_id` (the natural B2B convention, preferred) or `account_id`
(legacy alias -- both refer to the same vendor account UUID). If both are supplied,
`account_id` takes precedence. At least one is required.
**JSON body examples:**
Shape A (preferred -- vendor_id):
```json
{
"vendor_id": "df56267d-7890-41a2-a62c-ee8955aab150",
"notes": "Q3 stock order"
}
```
Shape B (alias -- account_id):
```json
{
"account_id": "df56267d-7890-41a2-a62c-ee8955aab150",
"notes": "Q3 stock order"
}
```
## OpenAPI
````yaml /openapi.yaml post /purchase-orders
openapi: 3.1.0
info:
title: Arcus ERP Public API
version: 1.0.0
description: >
Arcus ERP public REST API. Designed for external integrations and data
migration.
**Authentication.** Bearer token (API key) via the `Authorization` header.
Format: `Authorization: Bearer ark_live_ent__` (or
`ark_test_*` for sandbox).
API keys are issued per-entity in **Settings > Developers > API Keys**.
**Entity scoping.** The entity is encoded in the API key prefix; routes are
flat
(e.g. `/v1/accounts`, `/v1/orders`, `/v1/products`). A small set of platform
endpoints
(migration, reconciliation, events, webhook endpoints, API keys) use the
`/v1/entities/{entity_id}/...` form -- those are noted in their tags.
**Key capabilities.**
- Related-resource hydration via `?expand[]=` (see `x-arcus-expand` on each resource).
- Cursor-based pagination (`starting_after` / `ending_before` / `limit`).
- Idempotency via the `Idempotency-Key` header.
- Webhook events for asynchronous notification.
- Conditional requests / ETag for cache validation.
servers:
- url: https://api.arcuserp.com/v1
description: Arcus ERP API (accepts both live `ark_live_*` and test `ark_test_*` keys)
- url: https://dev-api.arcuserp.com/v1
description: >-
Dev sandbox API (test-only data, accepts `ark_test_*` keys against dev
RDS)
security: []
paths:
/purchase-orders:
post:
tags:
- Purchasing
summary: Create a purchase order
description: >
Required API key scope: `purchasing:write`
Creates a new purchase order in `draft` status. You must identify the
vendor
using either `vendor_id` (the natural B2B convention, preferred) or
`account_id`
(legacy alias -- both refer to the same vendor account UUID). If both
are supplied,
`account_id` takes precedence. At least one is required.
**JSON body examples:**
Shape A (preferred -- vendor_id):
```json
{
"vendor_id": "df56267d-7890-41a2-a62c-ee8955aab150",
"notes": "Q3 stock order"
}
```
Shape B (alias -- account_id):
```json
{
"account_id": "df56267d-7890-41a2-a62c-ee8955aab150",
"notes": "Q3 stock order"
}
```
operationId: createPurchaseOrderV1
requestBody:
required: true
content:
application/json:
schema:
type: object
description: >
Either `vendor_id` or `account_id` is required (both refer to
the same
vendor account UUID). `vendor_id` is the preferred B2B
convention;
`account_id` is the legacy internal alias. If both are present,
`account_id` wins.
properties:
vendor_id:
type: string
format: uuid
description: >
UUID of the vendor account (preferred field name -- matches
B2B convention used throughout the purchasing API). Alias
for account_id.
account_id:
type: string
format: uuid
description: >
UUID of the vendor account (legacy internal alias for
vendor_id). Accepted for backward compatibility. If both
vendor_id and account_id are provided, account_id takes
precedence.
location_id:
type: string
format: uuid
payment_term_id:
type: string
format: uuid
expected_date:
type: string
format: date
notes:
type: string
items:
type: array
items:
type: object
required:
- product_id
- quantity
- unit_cost
properties:
product_id:
type: string
format: uuid
quantity:
type: number
unit_cost:
type: number
responses:
'201':
description: Created purchase order
content:
application/json:
schema:
$ref: '#/components/schemas/PurchaseOrder'
'400':
$ref: '#/components/responses/Error'
'401':
$ref: '#/components/responses/Error'
'403':
$ref: '#/components/responses/Error'
security:
- ApiKeyAuth: []
components:
schemas:
PurchaseOrder:
type: object
description: A purchase order issued to a vendor.
properties:
id:
type: string
format: uuid
object:
type: string
enum:
- purchase_order
entity_id:
type: string
format: uuid
readOnly: true
po_number:
type: string
readOnly: true
vendor_id:
type: string
format: uuid
location_id:
type: string
format: uuid
nullable: true
status:
type: string
enum:
- draft
- approved
- sent
- partially_received
- received
- closed
- cancelled
readOnly: true
po_date:
type: string
format: date-time
expected_date:
type: string
format: date-time
nullable: true
subtotal:
type: number
tax_total:
type: number
shipping_total:
type: number
po_total:
type: number
currency:
type: string
default: USD
notes:
type: string
nullable: true
internal_notes:
type: string
nullable: true
metadata:
type: object
nullable: true
created_at:
type: string
format: date-time
readOnly: true
updated_at:
type: string
format: date-time
readOnly: true
ErrorEnvelope:
type: object
description: |
Canonical error response envelope. All API errors use this shape.
required:
- error
- code
properties:
error:
type: string
description: Machine-readable error key
example: not_found
code:
type: string
description: Machine-readable error code (often same as error)
example: not_found
type:
type: string
enum:
- validation_error
- permission_error
- not_found
- conflict
- rate_limit
- internal
- expand_error
- not_implemented
example: not_found
hint:
type: string
description: Human-readable one-sentence explanation (English)
example: >-
The requested order does not exist or does not belong to this
entity.
param:
type: string
description: The parameter that caused the error, if applicable
example: expand[0]
required:
type: string
description: The scope required (only on insufficient_scope errors)
example: accounts:read
request_id:
type: string
description: >-
Unique request ID for support tracing (maps to CloudWatch log
stream)
example: req_abc123
responses:
Error:
description: Error response (400/401/403/404/409/422/429/500)
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
securitySchemes:
ApiKeyAuth:
type: http
scheme: bearer
description: |
API key issued per entity via Settings > Developers > API Keys.
Each key carries scopes (e.g. orders:read, products:write).
Bearer token format: Authorization: Bearer ark_live_ent__
Test keys use ark_test_ent__. Both are issued per entity
via Settings > Developers > API Keys.
````