Firm Planned Orders
POST/api/manufacturing/mrp/planned-orders/firm
Firm planned orders (planned -> firm), optionally pinning a quantity and/or a due date so later runs keep them. A firm planned order still is not a real order — use Release Planned Orders for that.
Authorization: requires the mrp.run permission and a token carrying the mrp:run scope (manufacturing:write also satisfies it).
Selection payload — either an explicit list of ids, or every planned order matching a set of filters:
- scope:
selected(default) acts onids;filteredacts on every row matchingfilter/filter_groupswithinmrp_run_id. - ids[]: planned-order ids. Required unless
scope=filtered. At most 1000 — usescope=filteredbeyond that. Ids that no longer exist come back as a 422 naming them (a planned order is replaced on every run, so a stale selection means the plan was re-run). - mrp_run_id: required when
scope=filtered— the run the filters are resolved against. - exclude_ids[]: rows to leave out after selecting everything matching the filters (max 1000).
- filter / filter_groups / sort: the same filters and sort GET /api/manufacturing/mrp/runs/{mrpRun}/planned-orders accepts, replayed to resolve the filtered set.
Also accepts: firm_quantity (numeric, greater than 0, below 1,000,000,000, at most 6 decimal places) and firm_due_date (date) — the values later runs hold the order at. Omit them to firm at the planned quantity and date.
A pinned quantity or due date describes ONE planned order, so it is only accepted alongside a single planned order: sending either with
scope=filtered, or with more than one id, comes back 422. Firm the rest without a pin, or one at a time. Rows that are not in theplannedstate are skipped rather than refused;skippedin the response says how many. Validation errors come back undererrors.<field>[]. Most are plain strings, but the firm_quantity bound reports an object carryingmessage, a stablecode(FirmQuantityExceededMax) and the offendingdata— parse defensively rather than assuming every entry is a string.
mrp:run|manufacturing:writeGrant this scope to your token under Settings → Developer → Personal Access Tokens.
Request
Responses
- 200
- 401
- 403
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Unprocessable Content
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.