Bulk Barcode Lookup
POST/api/products/barcode-lookup/bulk
Exact-match barcode or SKU lookup for a batch of codes in one request.
products:writeGrant this scope to your token under Settings → Developer → Personal Access Tokens.
Same resolution as Barcode Lookup — barcode is matched first, SKU is the fallback, and only active products are returned — but resolving many codes costs two indexed queries instead of one request per code. Intended for integrations that walk a catalog.
Accepts GET or POST. Use GET with a comma-separated codes value for short lists; use POST with a JSON array once the list is too long for a URL. Up to 500 codes per request.
The response is an object keyed by the code you submitted, so each result can be matched back to its input — with the SKU fallback in play, a flat list would not tell you which code produced which product. A code that matched nothing is returned with an explicit null rather than being left out.
Barcodes are not guaranteed unique. When more than one active product carries a code, the entry is marked "ambiguous": true and the product returned is the lowest-numbered match — stable across calls, but worth surfacing to a human rather than trusting blindly.
Authentication: Requires Bearer token.
Including stock levels — add ?with=inventory to return the aggregate (all-warehouse) stock figures alongside each match, instead of making a second call per product. It costs one extra indexed query for the whole batch, so a batch of 500 with stock levels still costs about the same as a batch of 5.
inventory_available is floored at zero and is what a picker can pull today. inventory_available_to_sell is the promiseable figure — it excludes stock in transit and subtracts backorders, and goes negative when commitments exceed stock on hand. A product that has never held stock has no inventory record and reads as zero across all six fields rather than null.
Request
Responses
- 200
- 401
- 403
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Unprocessable Content
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.