Get Portal Payload (3PL Portal)
GET/api/amazon/:integrationInstance/draft-inbound-plans/fulfillment-portal/:token
Anonymous 3PL/supplier fulfillment portal entry point. Access is granted by the opaque :token in the URL (the packet's portal_token) — no bearer auth (tenant.public-portal middleware). Returns the full portal payload the 3PL sees: shipment reference + FBA id, source, the destination fulfillment center (destination_fc) and its full destination address (destination_address, Amazon SP-API camelCase keys — null until Amazon assigns placement), shipping mode / LTL flags, condition-aware instructions (markdown, rendered inline by the portal), downloadable documents, the product catalogue for the box-contents packing station (products), the tenant's saved carton presets (carton_templates), any existing box_contents_submission / pallets_submission, and the confirm gating (can_confirm, confirm_blocked_reason).
Any valid API token can call this endpoint — no specific scope required. Manage tokens.
products[] fields: each item carries product_id, sku, name, image_url, msku, fnsku, barcode (UPC — enables barcode scanning in the portal), quantity (required units), label_owner / prep_owner (AMAZON | SELLER | NONE — SELLER label_owner means the 3PL applies FNSKU labels; SELLER prep_owner means the 3PL must prep the item before boxing), and the unit measurements saved on the product record: weight, weight_unit, length, width, height, dimension_unit.
documents[] lists only genuinely downloadable paperwork (kitting work order, FNSKU/box/pallet labels, BOL once attached). The renderable instructions and box_contents types are NOT listed — the portal renders instructions inline and collects box contents via its own form.
Every view is audit-logged (portal events). Returns 404 when the token is expired, rotated, or revoked.
prep_details (object|null): the operator's last persisted Amazon prep-details fetch — {details: [{msku, prepCategory, prepTypes[], ...}], fetched_at} — powering the portal's per-category "Required Prep Types" breakdown. Null when prep details were never fetched.
Request
Responses
- 200
- 401
- 403
- 404
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.