Accept Customer Quote
POST/api/public/quotes/:token/accept
Accepts the quote with a typed signature. The seller is alerted; accepting does not create the sales order — the seller does that.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Body
signer_name(required, string, 2–255) — the signer's full name, used as the signature.signer_email(optional, email, max 255).selected_line_ids(optional, array of up to 500 line ids) — the buyer's choice ofoptionallines and one line persingle_selectgroup. Standard lines are always included. Omit to keep the selection the quote was sent with. Each id must be a line on this quote and each group needs exactly one choice, else422 invalid_selection.accept_terms(required) — must betrue(agreement to the quote's terms).
The signer's IP address and browser are recorded with the signature. Only a sent or viewed quote can be accepted: an expired one answers 422 expired, an answered one 422 already_answered.
No login. The 64-character quote token in the URL is the only credential — send no bearer token. The request must go to the seller's own workspace domain (e.g. https://acme.sku.io): the workspace is identified from the request's domain, and any other domain answers 404. Returns 503 while the workspace is briefly under maintenance.
Every refusal is JSON {message, reason}: message is written for the buyer and reason is a stable code — not_found (404: unknown token, a quote that was never sent, or a quote answered on a sales channel), being_updated (422: the seller is revising the quote; also carries quote_number and seller_name), expired, already_answered, closed, invalid_selection (all 422).
Limited to 10 requests per minute per IP address (shared with decline and comment).
Returns the updated quote (same shape as Get Customer Quote).
Authentication: none (quote token in the URL).
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not Found
Response Headers
Unprocessable Entity
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.