Dropship (Ship Fulfillment)
POST/api/purchase-orders/:purchase_order/dropship
Create a dropship fulfillment for a dropship purchase order (ship directly to customer).
purchase-orders:writeGrant this scope to your token under Settings → Developer → Personal Access Tokens.
Body fields:
- tracking_number (string|null): null for a supplier pickup with no tracking number
- carrier (string, optional): carrier name, e.g. USPS
- shipping_method_id (integer, optional): SKU.io shipping method to record on the fulfillment
- shipping_method_name (string, optional): free-text service name when no shipping method id is given
- shipped_at (string, optional): ship date/time; defaults to now
- lines (array, optional): partial shipment — only these lines and quantities are fulfilled. Omit to fulfil every unfulfilled line.
- lines..sales_order_line_id or lines..purchase_order_line_id (integer): the line to ship
- lines.*.quantity (number)
- dropship_label_id (integer, optional): the dropship label this shipment ships on. Only that label's items and quantities are fulfilled (
linesis ignored; a full-order label ships every unfulfilled line on this PO), and the fulfillment is linked to the label. The label must belong to this purchase order and be purchased. Idempotent: if the label is already linked to a fulfillment, that fulfillment is returned instead of recording another.
When dropship_label_id is omitted but tracking_number matches one of this PO's purchased labels, the shipment is recorded on that label in the same way.
Returns 400 with a message when the fulfillment cannot be created (e.g. the label does not belong to this purchase order, or has not been purchased). A purchase order that was cancelled (by the supplier) or voided records no shipment: the request returns 400 and nothing is created.
Authentication: Requires Bearer token.
Requires permission: purchase_orders.update
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Bad Request
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.