Download PO CSV Sample

POST 
/api/suppliers/:supplier/csv-sample

Legacy proxy. Generate and download a 3-row sample CSV showing exactly which columns will be included in this supplier's outgoing PO email attachment.

Required scope: suppliers:write

Grant this scope to your token under Settings → Developer → Personal Access Tokens.

This endpoint is kept for backward compatibility — new clients should call POST /api/suppliers/:supplier/po-sample instead, which supports both CSV and XLSX (format=xlsx). Internally this route forwards to po-sample with format=csv forced.

Used by the per-supplier CSV column picker so users can preview the layout before saving.

Request body (all optional):

• columns (array of strings) — Unsaved column selection to preview. If omitted, the saved supplier preference is used; if that is also empty, the tenant default falls through, then the system default (every registered column).

Valid column keys (current registry): purchase_order, sku, barcode, supplier_sku, name, qty_ordered, unit_cost, extended_cost. Unknown keys are silently dropped.

The response is a CSV file download (Content-Type: text/csv), not JSON.

Authentication: Requires Bearer token. Scope: suppliers:rw.

Request

Responses

200

Successful response

401

Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.

403

Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.

404

Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.

422

Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.

429

Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.