Update Supplier
PUT/api/suppliers/:supplier
Update an existing supplier. All fields are optional.
suppliers:writeGrant this scope to your token under Settings → Developer → Personal Access Tokens.
-
messaging_phone— the supplier's WhatsApp/SMS number in international format (E.164, e.g. +15551234567), used to message them from a purchase order. -
purchase_order_format— only allowed on PUT. -
purchase_order_csv_columns— optional array of column keys controlling which columns appear in this supplier's outgoing PO email CSV attachment. Each entry must be one of the keys returned byGET /api/purchase-orders/csv-columns. Set tonull(or omit) to fall back to the tenant default. Set to an empty array to fall back to the tenant default. Order of the array determines column order in the CSV. Use thePOST /api/suppliers/:supplier/csv-sampleendpoint to preview the layout.
Authentication: Requires Bearer token. Requires IsPowerUserAccess middleware.
Requires permission: suppliers.update
Clearing default_incoterm_id (sending it as null/empty) also clears default_incoterm_place — a default named place is never kept without a default term.
Custom fields: custom_field_values (optional array) fully replaces the supplier's stored custom field values when present — entries with an id update that existing value (the id must reference a custom-field value belonging to THIS supplier; a value id from another supplier is rejected with a 422), entries without one create a new value (custom_field_id required, must reference a custom field defined for suppliers), and any stored value row omitted from the array is deleted. Omit the key entirely to leave stored values untouched.
Advanced lead times: warehouse_lead_times (optional array of { warehouse_id, leadtime }) sets supplier-level per-warehouse lead-time overrides. Rows with a warehouse_id and a numeric leadtime are upserted; a warehouse omitted from the array has its override removed. Omit the key to leave overrides untouched.
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.