# API reference

> A RESTful API for the entire PurchasePlus platform. Resource-oriented URLs, JSON responses, standard HTTP codes, and full endpoint documentation.

Source: https://www.purchaseplus.com/pl/docs/api

Markdown: https://www.purchaseplus.com/pl/docs/api.md

A RESTful API for the entire PurchasePlus platform. Resource-oriented URLs, JSON responses, standard HTTP codes, and full endpoint documentation.

Resource-oriented URLs, form-encoded request bodies, JSON-encoded responses, standard HTTP response codes, and a mix of standard and extended action verbs.

## Environments

- Production: `https://api.purchaseplus.com`
- Staging: `https://api.rc-purchaseplus.com`

## Modules

- [Purchasing](https://purchaseplus.com/api-docs/index.html?urls.primaryName=Purchasing%20API%20V2) — Purchase orders, approvals, receiving notes, and supplier interactions.
- [Invoicing](https://purchaseplus.com/api-docs/index.html?urls.primaryName=Invoicing%20API%20V2) — Invoices, AP automation, 3-way matching, approvals, and accounting exports.
- [Inventory](https://purchaseplus.com/api-docs/index.html?urls.primaryName=Inventory%20API%20V2) — Stock levels, stocktakes, transfers, and variance tracking.
- [Point of Sale](https://purchaseplus.com/api-docs/index.html?urls.primaryName=Point%20Of%20Sale%20API%20V3) — Point of sale transactions, sales records, and till integration data.
- [Supply](https://purchaseplus.com/api-docs/index.html?urls.primaryName=Supply%20API%20V2) — Supplier catalogues, product listings, pricing, and availability data.
- [Recipes](https://purchaseplus.com/api-docs/index.html?urls.primaryName=Recipes%20API%20V2) — Recipes, menu items, ingredients, and costings.

## Authentication

Token-based. Sign in at `/access/api/auth/sign_in` and send `Access-token`, `Client`, and `Uid` on later requests. Use `Accept: application/vnd.mbapi.v2+json`.

## Authorisation

Personas assigned in the PurchasePlus UI control what an authenticated user can access.

## Errors

Standard HTTP codes, including 401 for invalid tokens, 403 for persona permission, and 429 for the 5 requests-per-second limit.

## Pagination, links, and filtering

Use the `page` parameter for collections. Responses include `links` (`self`, `first`, `last`, `next`, `prev`) and optional `included` related resources. Filter with `filter[field_predicate]=value`.

## Versioning and idempotency

Current version is 2.0 via the Accept header. Optional `Idempotency-Key` (UUID) on POST and PATCH. Rate limit is 5 requests per second per IP. Request ids are returned in `PP-Request-Id`.