Purchase orders

Approve a purchase order

Approves the order and leaves it in pending.

POST
/api/v1/purchase-orders/{purchaseOrderId}/approve

Request examples

curl https://app.filmo.io/api/v1/purchase-orders/purc_8f2a1c/approve \
  --request POST \
  --header "Authorization: Bearer $FILMO_API_KEY" \
  --header "Idempotency-Key: $(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)"
{
  "data": {
    "id": "purchase_order_9f3a2b",
    "poNumber": "2026-0001",
    "status": "draft",
    "type": "subrental",
    "isDraft": true,
    "poDate": "2026-09-01T08:00:00.000Z",
    "supplierId": "supplier_9f3a2b",
    "reference": "2026-0001",
    "currency": "EUR",
    "subTotal": "120.00",
    "discountTotal": "120.00",
    "taxesPrice": "120.00",
    "netPrice": "120.00",
    "grossPrice": "120.00",
    "totalPaid": "120.00",
    "orderId": "order_9f3a2b",
    "orderNumber": "2026-0001",
    "projectId": "project_9f3a2b",
    "repairTicketId": "repair_ticket_9f3a2b",
    "notes": "Example text.",
    "createdAt": "2026-09-01T08:00:00.000Z",
    "updatedAt": "2026-09-01T08:00:00.000Z"
  }
}

Generated from the schema

It takes no body, and it is a sub-resource and not a patch of status because the server checks the order before moving it. Only a draft with a supplier is approved: any other status —an order already approved, too— responds 409 conflict naming it, and a draft without supplier responds 409 as well; nothing changes in either case. Returns the full purchase order, the same projection as its GET.

Authorizations

Bearer API key with the scope below. purchase-orders:write

Headers

Idempotency-Keystring

Unique identifier of the request, chosen by the client (a UUID works). Between 1 and 255 characters: an empty header is rejected with 400 validation_error, because the client would believe itself protected. Repeating the same key with the SAME body within 24 h returns the stored response without executing again, with the Idempotent-Replay: true header. With a DIFFERENT body it returns 422. It is the safe way to retry after a network timeout.

Limits: min length 1, max length 255

Example:"9f1c2f4e-3a5b-4f6d-8e7a-0b1c2d3e4f5a"

If-Matchstring

Optimistic locking: the ETag you read from the resource (or *). If the resource changed since, the write is rejected with 412 precondition_failed before doing anything; read it again and retry. Without the header the write always proceeds.

Example:"\"3sT3d9pBvZq4h2N0w8x1YkLmQ7c\""

Path parameters

purchaseOrderIdstringRequired

Purchase order identifier.

Limits: min length 1

Response

application/json

Successful response.

Response schema: PurchaseOrderDto

Envelope: PurchaseOrderResponse. meta.warnings is present only when the operation is deprecated.

Headers: X-Request-Id · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · ETag · Idempotent-Replay

dataobject

Purchase order to a supplier. The amounts are COST amounts, because the object is a purchase. The lines are not published, so the expense cannot be attributed to a specific item of a rental.

Show child attributes
data.idstring

Unique purchase order identifier.

data.poNumberstring | null

Purchase order number; null while it is a draft.

data.statusstring

Purchase order status.

Available options: draft, pending, completed, cancelled

data.typestring

Purchase order type.

Available options: subrental, stock_purchase, resale_purchase, consumable_purchase, technician, transport, repair, consignment

data.isDraftboolean

true if the purchase order is still a draft.

data.poDatestring<date-time> | null

Purchase order date in ISO 8601 UTC; null if not set.

data.supplierIdstring | null

Supplier identifier; null while a draft has no supplier. Resolve it against /api/v1/contacts.

data.referencestring | null

Free-form reference of the purchase order; null if it has none.

data.currencystring

Currency of the purchase order, as an ISO 4217 code.

data.subTotalstring

Subtotal before discounts and taxes, as a decimal string "1234.50".

Limits: pattern ^-?\d+\.\d{2}$

data.discountTotalstring

Discount total, as a decimal string "1234.50".

Limits: pattern ^-?\d+\.\d{2}$

data.taxesPricestring

Tax total, as a decimal string "1234.50".

Limits: pattern ^-?\d+\.\d{2}$

data.netPricestring

Taxable base, as a decimal string "1234.50".

Limits: pattern ^-?\d+\.\d{2}$

data.grossPricestring

Total including taxes, as a decimal string "1234.50".

Limits: pattern ^-?\d+\.\d{2}$

data.totalPaidstring | null

Amount already paid, as a decimal string "1234.50"; null if no payment has been recorded.

Limits: pattern ^-?\d+\.\d{2}$

data.orderIdstring | null

Associated rental order; null if it has none.

data.orderNumberstring | null

Number of that order; null if it has none.

data.projectIdstring | null

Associated project; null if it has none.

data.repairTicketIdstring | null

Repair ticket that originated the purchase; null if it does not come from one.

data.notesstring | null

Purchase order notes; null if it has none.

data.createdAtstring<date-time>

Creation date in ISO 8601 UTC.

data.updatedAtstring<date-time>

Last modification date in ISO 8601 UTC.

metaobject

Additional information about the response.

Show child attributes
meta.warningsobject[]

Lifecycle warnings; present only when the operation is deprecated.

Show child attributes
meta.warnings.codestring

Stable warning code.

Available options: deprecated

meta.warnings.messagestring

For people: what is deprecated, until when, and what to use.

meta.warnings.sunsetstring

Day (YYYY-MM-DD) the operation stops being served.

meta.warnings.replacementstring | null

operationId of the operation to use instead, or null if there is none.

Errors

StatusCodesMeaning
402addon_requiredThe account plan does not include the add-on this operation needs; requiredAddon names it.
404not_foundIt does not exist or is outside the scope of the API key.
409conflictThe current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (If-Match) held the resource for more than five seconds. errors[0].code says which: in_progress and lock_timeout are solved by retrying; invalid_state is not, because the state of the resource forbids the operation.
412precondition_failedThe If-Match entity tag does not match the current representation. Read the resource again and retry.
422idempotency_key_reusedThe same key was used before with a different body. Change the key.

401, 403, 429, 500 can be returned by any operation. Errors

Deprecation

This operation is not deprecated. Deprecations are announced with a Deprecation header and a sunset date. Versioning policy