Purchase orders
Update a purchase order
Changes the header of a purchase order.
purchase-orders:write- 120/min
- Strict tenancy
- Add-on (402)
- Idempotency-Key
- If-Match
- MCP: filmo_purchase_orders_update
Request examples
curl https://app.filmo.io/api/v1/purchase-orders/purc_8f2a1c \
--request PATCH \
--header "Authorization: Bearer $FILMO_API_KEY" \
--header "Idempotency-Key: $(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)" \
--header 'Content-Type: application/json' \
--data '{
"type": "stock_purchase",
"supplierId": "cont_proveedor_01",
"poDate": "2026-09-01T00:00:00+02:00",
"supplierQuoteRef": "PRE-2026-118",
"reference": "Reposición de trípodes"
}'Generated from the schema
type always goes, even if it does not change: the approval flow and the numbering series depend on it. LINES are not touched from here, because they are not published; the server calculates the totals from them. The supplier snapshot, the numbering series and the custom fields are left out of the public body. It requires the purchases add-on (402 without it); a consignment purchase order —the stored type or the one you send is consignment— also requires the consignments add-on, and without it the response is 402 with requiredAddon: consignments and nothing is written. A cancelled purchase order, or one locked in the app, cannot be edited: 409 conflict and nothing is written. Returns the full purchase order, the same projection as its GET.
Authorizations
Bearer API key with the scope below. purchase-orders:write
Headers
Unique identifier of the request, chosen by the client (a UUID works). Between 1 and 255 characters: an empty header is rejected with 400 validation_error, because the client would believe itself protected. Repeating the same key with the SAME body within 24 h returns the stored response without executing again, with the Idempotent-Replay: true header. With a DIFFERENT body it returns 422. It is the safe way to retry after a network timeout.
Limits: min length 1, max length 255
Example:"9f1c2f4e-3a5b-4f6d-8e7a-0b1c2d3e4f5a"
Optimistic locking: the ETag you read from the resource (or *). If the resource changed since, the write is rejected with 412 precondition_failed before doing anything; read it again and retry. Without the header the write always proceeds.
Example:"\"3sT3d9pBvZq4h2N0w8x1YkLmQ7c\""
Path parameters
Purchase order identifier.
Limits: min length 1
Body
Body schema: PurchaseOrderUpdateBody
Purchase order type.
Available options: subrental, stock_purchase, resale_purchase, consumable_purchase, technician, transport, repair, consignment
Supplier of the purchase order; null leaves it without a supplier (drafts only).
Issue date, in ISO 8601 with offset; null clears it.
Reference of the supplier quote; null clears it.
Limits: max length 200
Internal reference of the document; null clears it.
Limits: max length 200
Currency, as an ISO 4217 code.
Limits: min length 3, max length 3
Associated project; null unlinks it.
Associated rental order; null unlinks it.
Notes; null clears them.
Limits: max length 5000
Response
Successful response.
Response schema: PurchaseOrderDto
Envelope: PurchaseOrderResponse. meta. is present only when the operation is deprecated.
Headers: X-Request-Id · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · ETag · Idempotent-Replay
Purchase order to a supplier. The amounts are COST amounts, because the object is a purchase. The lines are not published, so the expense cannot be attributed to a specific item of a rental.
Show child attributesHide child attributes
Unique purchase order identifier.
Purchase order number; null while it is a draft.
Purchase order status.
Available options: draft, pending, completed, cancelled
Purchase order type.
Available options: subrental, stock_purchase, resale_purchase, consumable_purchase, technician, transport, repair, consignment
true if the purchase order is still a draft.
Purchase order date in ISO 8601 UTC; null if not set.
Supplier identifier; null while a draft has no supplier. Resolve it against /api.
Free-form reference of the purchase order; null if it has none.
Currency of the purchase order, as an ISO 4217 code.
Subtotal before discounts and taxes, as a decimal string "1234.50".
Limits: pattern ^-?\d+\.\d{2}$
Discount total, as a decimal string "1234.50".
Limits: pattern ^-?\d+\.\d{2}$
Tax total, as a decimal string "1234.50".
Limits: pattern ^-?\d+\.\d{2}$
Taxable base, as a decimal string "1234.50".
Limits: pattern ^-?\d+\.\d{2}$
Total including taxes, as a decimal string "1234.50".
Limits: pattern ^-?\d+\.\d{2}$
Amount already paid, as a decimal string "1234.50"; null if no payment has been recorded.
Limits: pattern ^-?\d+\.\d{2}$
Associated rental order; null if it has none.
Number of that order; null if it has none.
Associated project; null if it has none.
Repair ticket that originated the purchase; null if it does not come from one.
Purchase order notes; null if it has none.
Creation date in ISO 8601 UTC.
Last modification date in ISO 8601 UTC.
Additional information about the response.
Show child attributesHide child attributes
Lifecycle warnings; present only when the operation is deprecated.
Show child attributesHide child attributes
Stable warning code.
Available options: deprecated
For people: what is deprecated, until when, and what to use.
Day (YYYY-MM-DD) the operation stops being served.
operationId of the operation to use instead, or null if there is none.
Where the deprecation is documented (the changelog).
Invalid request (validation_error): malformed query or body. errors[] lists every offending field with its stable code.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Authentication failed (unauthorized, api_key_invalid, api_key_revoked, api_key_expired, api_key_owner_inactive, api_key_owner_not_admin).
Headers: X-Request-Id · Content-Language · Idempotent-Replay
Add-on required (addon_required): the account plan does not include the add-on this operation needs; requiredAddon names it.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Not allowed (insufficient_scope: the API key does not have the required scope, named in requiredScope; forbidden: the owner of the key lacks the permission the operation requires). insufficient_scope is answered before the request counts against the rate limit, so it carries no RateLimit-* headers; forbidden does.
Headers: X-Request-Id · Content-Language · Idempotent-Replay
Resource not found (not_found): it does not exist or is outside the scope of the API key.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Conflict (conflict): the current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (If-Match) held the resource for more than five seconds. errors[0]. says which: in_progress and lock_timeout are solved by retrying; invalid_state is not, because the state of the resource forbids the operation.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Precondition failed (precondition_failed): the If-Match entity tag does not match the current representation. Read the resource again and retry.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Idempotency-Key reused (idempotency_key_reused): the same key was used before with a different body. Change the key.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Rate limit exceeded (rate_limited): retry after Retry-After seconds; RateLimit-* says which quota ran out.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Retry-After · Idempotent-Replay
Internal error (internal_error).
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Errors
| Status | Codes | Meaning |
|---|---|---|
| 400 | validation_error | Malformed query or body. errors[] lists every offending field with its stable code. |
| 402 | addon_required | The account plan does not include the add-on this operation needs; requiredAddon names it. |
| 404 | not_found | It does not exist or is outside the scope of the API key. |
| 409 | conflict | The current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (If-Match) held the resource for more than five seconds. errors[0]. says which: in_progress and lock_timeout are solved by retrying; invalid_state is not, because the state of the resource forbids the operation. |
| 412 | precondition_failed | The If-Match entity tag does not match the current representation. Read the resource again and retry. |
| 422 | idempotency_key_reused | The same key was used before with a different body. Change the key. |
401, 403, 429, 500 can be returned by any operation. Errors
Deprecation
This operation is not deprecated. Deprecations are announced with a Deprecation header and a sunset date. Versioning policy
Related
Related pages
Link to this section: Related pagesFinance
Purchase order
Purchase order to a supplier.
Was this page helpful?