CanopyDocs
Reference

Clients

GET
/api/clients/lookup

Fuzzy lookup (case/whitespace-insensitive) to resolve a client name → id. Pass that id as X-Client-Id on other list calls to scope them to that client. A client-pinned credential only ever sees its own client — call this once with no search to read your own defaultWarehouseId, the warehouse your order creates land in when they name none.

Authorization

oauth2 clients:read
AuthorizationBearer <token>

OAuth2 client-credentials grant.

In: header

Scope: clients:read

Query Parameters

search?string

Fuzzy match on name (case- and whitespace-insensitive). Omit to list all.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/api/clients/lookup"
{  "success": true,  "data": [    {      "id": "string",      "name": "string",      "code": "string",      "defaultWarehouseId": "string",      "defaultWarehouseName": "string"    }  ]}
GET
/api/warehouse/warehouses

The tenant's active warehouses. Use an id as X-Warehouse-Id on list calls to narrow them to one facility (omit the header for every warehouse), or — from a tenant-wide credential only — as warehouseId on POST /api/orders to pin the order to a warehouse.

Authorization

oauth2 clients:read
AuthorizationBearer <token>

OAuth2 client-credentials grant.

In: header

Scope: clients:read

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/api/warehouse/warehouses"
{  "success": true,  "data": [    {      "id": "string",      "name": "string",      "address": "string",      "addressLine2": "string",      "city": "string",      "state": "string",      "zipCode": "string",      "country": "string",      "phone": "string",      "isActive": true,      "businessTimezone": "string",      "createdAt": "2019-08-24T14:15:22Z",      "updatedAt": "2019-08-24T14:15:22Z"    }  ]}
GET
/api/clients/{id}/health

Orders fulfilled, on-time rate, average fulfilment hours, orders received, returns and return rate (customer returns only; returned-to-sender parcels are counted separately as rtsCreated) for a window, each against the equal window before it, plus a live backlog block. Rate deltas are in PERCENTAGE POINTS (onTimeRateDeltaPoints); volume deltas are percent change. On-time uses the same business-hour definition as the operator dashboard.

Authorization

oauth2 orders:read
AuthorizationBearer <token>

OAuth2 client-credentials grant.

In: header

Scope: orders:read

Path Parameters

id*string

Client id

Query Parameters

days?number

Window length; the previous window is the same length before it.

Range1 <= value <= 90
Default7
timezone?string

IANA zone used for the 'today' boundary in the backlog block.

Default"UTC"

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/api/clients/string/health"
{  "success": true,  "data": {    "clientId": "string",    "clientName": "string",    "window": {      "days": 0,      "from": "2019-08-24T14:15:22Z",      "to": "2019-08-24T14:15:22Z"    },    "previousWindow": {      "from": "2019-08-24T14:15:22Z",      "to": "2019-08-24T14:15:22Z"    },    "fulfillment": {      "fulfilled": 0,      "previousFulfilled": 0,      "fulfilledChangePct": 0,      "onTimeRatePct": 0,      "previousOnTimeRatePct": 0,      "onTimeRateDeltaPoints": 0,      "avgBusinessHours": 0,      "previousAvgBusinessHours": 0,      "slaTargetHours": 0    },    "intake": {      "ordersReceived": 0,      "previousOrdersReceived": 0,      "ordersReceivedChangePct": 0    },    "returns": {      "created": 0,      "previousCreated": 0,      "returnRatePct": 0,      "previousReturnRatePct": 0,      "returnRateDeltaPoints": 0,      "rtsCreated": 0,      "previousRtsCreated": 0    },    "backlog": {      "openOrders": 0,      "lateOpenOrders": 0,      "onHold": 0,      "backordered": 0,      "openInbound": 0    }  }}
GET
/api/clients/{id}/agent-policy

Tenant-wide credentials only. A credential pinned to one client is refused (403), as that client's portal users are; use a tenant-wide credential with X-Client-Id. 3PL-authored business rules an automated caller must follow when an action involves judgment (order priorities, holds, contested stock). policy: null means the client has no policy set — treat judgment calls as requiring a human. Cite the policy version in any note whose action it drove.

Authorization

oauth2 policy:read
AuthorizationBearer <token>

OAuth2 client-credentials grant.

In: header

Scope: policy:read

Path Parameters

id*string

Client id

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/api/clients/string/agent-policy"
{  "success": true,  "data": {    "clientId": "string",    "clientName": "string",    "policy": {      "version": 0,      "updatedAt": "2019-08-24T14:15:22Z",      "rules": [        {          "id": "string",          "rule": "string",          "governs": "hold_order"        }      ]    },    "decisions": [      {        "value": "string",        "label": "string"      }    ]  }}
PUT
/api/clients/{id}/agent-policy

Tenant-wide credentials only. A credential pinned to one client is refused (403), as that client's portal users are; use a tenant-wide credential with X-Client-Id. Replace the whole rules list. The server bumps version itself and stamps updatedAt; callers never supply a version. Intended for the policy-editor surface, not for agent runtime credentials.

Authorization

oauth2 policy:write
AuthorizationBearer <token>

OAuth2 client-credentials grant.

In: header

Scope: policy:write

Path Parameters

id*string

Client id

Header Parameters

Idempotency-Key?string

Optional client-supplied key that makes this write safe to retry. A replay of a completed key returns the original response; an in-flight duplicate gets 409. A key is bound to the operation — method, URL and request body — and to the caller — the credential and its token scopes; reusing it with any of those changed gets 422.

Lengthlength <= 255

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PUT "https://example.com/api/clients/string/agent-policy" \  -H "Content-Type: application/json" \  -d '{    "rules": [      {        "id": "string",        "governs": "hold_order",        "rule": "string"      }    ]  }'
{  "success": true,  "data": {    "clientId": "string",    "clientName": "string",    "policy": {      "version": 0,      "updatedAt": "2019-08-24T14:15:22Z",      "rules": [        {          "id": "string",          "rule": "string",          "governs": "hold_order"        }      ]    }  }}