# Business Made · Bills Part of AppEngine API Documentation. Full index: https://appengine.appmint.io/documentation.md ## GET /business-made/bills **List bills** `operationId: BillController_list` Supplier bills across the org. #### Signature ```http GET /business-made/bills (status?: string, vendorId?: string, businessLocationId?: string, page?: integer, pageSize?: integer) -> Bills ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/bills/aging` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `status` | query | string | — | | | `vendorId` | query | string | — | | | `businessLocationId` | query | string | — | Restrict to one location. | | `page` | query | integer | — | | | `pageSize` | query | integer | — | | ### Responses | Status | Meaning | | --- | --- | | `200` | Bills | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/bills **Create a bill** `operationId: BillController_create` Records a supplier bill. `vendorId`, `businessLocationId`, `billDate` and `dueDate` are all required — the due date is what drives the aging report. Money is in **currency units, not cents**: a $412.50 bill is `amount: 412.5`. Send `lines[]` ({ description, quantity, unitPrice }) for an itemised bill, or just `amount` for a one-line bill — the total and balance are computed from the lines. #### Signature ```http POST /business-made/bills (body) -> The created bill ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `400` | — | vendorId, businessLocationId, billDate, dueDate required | Any of the four required fields is absent. | All four are mandatory — the message lists them. | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/bills/{id}/approve` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Request body The bill to record. ```json { "vendorId": "VEN-4821", "businessLocationId": "loc_london", "billDate": "2026-09-01", "dueDate": "2026-10-01", "amount": 412.5, "reference": "INV-99182", "description": "Produce" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The created bill | | `400` | vendorId, businessLocationId, billDate, dueDate required — Any of the four required fields is absent. | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/bills/aging **Get bill aging** `operationId: BillController_aging` Payables bucketed by how overdue they are — what is owed, and how late. #### Signature ```http GET /business-made/bills/aging (businessLocationId?: string) -> Aged payables ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/bills/{id}/pay` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `businessLocationId` | query | string | — | Restrict to one location. | ### Responses | Status | Meaning | | --- | --- | | `200` | Aged payables | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/bills/payments **List bill payments** `operationId: BillController_listPayments` Payments made against supplier bills. #### Signature ```http GET /business-made/bills/payments (billId?: string) -> Bill payments ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/bills/{id}/pay` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `billId` | query | string | — | Only payments against this bill. | ### Responses | Status | Meaning | | --- | --- | | `200` | Bill payments | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/bills/{id} **Get a bill** `operationId: BillController_get` Fetches one bill with its lines and payment history. #### Signature ```http GET /business-made/bills/{id} (id: string) -> The bill ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/bills/{id}/approve` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `200` | The bill | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## DELETE /business-made/bills/{id} **Delete a bill** `operationId: BillController_remove` Deletes a bill. Void it instead once it has been approved — the record of an approved obligation should survive. #### Signature ```http DELETE /business-made/bills/{id} (id: string) -> Deletion result ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/bills/{id}/void` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `200` | Deletion result | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/bills/update **Update a bill** `operationId: BillController_update` Updates a bill. Approving and paying have their own endpoints that enforce the state rules. #### Signature ```http POST /business-made/bills/update (body) -> The updated bill ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `400` | — | sk (the bill id) is required | The body has no `sk`. | — | | `404` | — | Bill not found | No bill has that id. | Check the id with `GET /business-made/bills`. | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/bills/{id}/approve` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Request body The bill to update. ```json { "id": "BIL-4821", "dueDate": "2026-10-15" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated bill | | `400` | sk (the bill id) is required — The body has no `sk`. | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Bill not found — No bill has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/bills/{id}/approve **Approve a bill** `operationId: BillController_approve` Approves a bill for payment. Only a bill in an approvable state can be approved — the error names the status that blocked it. #### Signature ```http POST /business-made/bills/{id}/approve (id: string) -> The approved bill ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Bill not found | No bill has that id. | Check the id with `GET /business-made/bills`. | | `400` | INVALID_STATUS | Cannot approve bill in status | The bill is voided or already approved. | The message names the current status. | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/bills/{id}/pay` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `201` | The approved bill | | `400` | Cannot approve bill in status — The bill is voided or already approved. | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Bill not found — No bill has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/bills/{id}/void **Void a bill** `operationId: BillController_void_` Voids a bill so it cannot be paid, keeping the record. The right response to a supplier invoice raised in error. #### Signature ```http POST /business-made/bills/{id}/void (id: string, body) -> The voided bill ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Bill not found | No bill has that id. | Check the id with `GET /business-made/bills`. | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/bills/{id}/pay` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Request body Optional reason. ```json { "reason": "Duplicate of INV-99181" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The voided bill | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Bill not found — No bill has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/bills/{id}/pay **Pay a bill** `operationId: BillController_pay` Records a payment against a bill. Partial payments are supported — call it repeatedly until the balance clears. Two guards apply: a voided bill cannot be paid, and a payment exceeding the remaining balance is refused with both figures in the message. #### Signature ```http POST /business-made/bills/{id}/pay (id: string, body) -> The updated bill ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Notes - Not idempotent — a retry records a second payment. #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Bill not found | No bill has that id. | Check the id with `GET /business-made/bills`. | | `400` | — | Cannot pay voided bill | The bill has been voided. | Raise a new bill if the obligation is real. | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/bills/payments` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Request body The payment. ```json { "amount": 1200, "method": "bank_transfer", "reference": "BACS-99182", "date": "2026-09-25" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated bill | | `400` | Cannot pay voided bill — The bill has been voided. | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Bill not found — No bill has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/bills/../vendors **List vendors (broken route)** `operationId: BillController_listVendors` Intended to list vendors, but **the route path is malformed**. It is declared as `@Get('../vendors')` inside the bills controller, and a route decorator is not a filesystem path — the `..` is taken literally, so the endpoint registers at `/business-made/bills/../vendors`. Most HTTP clients normalise `..` out of a URL before sending it, which means a request for that path usually arrives as `/business-made/vendors` and never reaches this handler at all. Treat the endpoint as unreachable and use `GET /business-made/vendors`, which is the properly-mounted route on the vendor controller. #### Signature ```http GET /business-made/bills/../vendors () -> Vendors, if the route can be reached at all ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Notes - The `..` is a defect in the route declaration, not a path shorthand. - Use `GET /business-made/vendors` instead. #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/vendors` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Responses | Status | Meaning | | --- | --- | | `200` | Vendors, if the route can be reached at all | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/vendors **List vendors** `operationId: VendorController_list` Suppliers the org buys from. #### Signature ```http GET /business-made/vendors () -> Vendors ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/bills` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Responses | Status | Meaning | | --- | --- | | `200` | Vendors | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/vendors **Create a vendor** `operationId: VendorController_create` Adds a supplier. Bank details recorded here are where payments go — treat a change to them as a security event, not a routine edit. #### Signature ```http POST /business-made/vendors (body) -> The created vendor ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/vendors/update` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Request body The vendor to create. ```json { "name": "Acme Supplies Ltd", "paymentTermsDays": 30, "email": "ap@acmesupplies.com" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The created vendor | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/vendors/{id} **Get a vendor** `operationId: VendorController_get` Fetches one vendor with its terms and contact details. #### Signature ```http GET /business-made/vendors/{id} (id: string) -> The vendor ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/bills` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `200` | The vendor | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## DELETE /business-made/vendors/{id} **Delete a vendor** `operationId: VendorController_remove` Deletes a supplier. Bills referencing it are not removed. #### Signature ```http DELETE /business-made/vendors/{id} (id: string) -> Deletion result ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/bills` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `200` | Deletion result | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/vendors/update **Update a vendor** `operationId: VendorController_update` Updates a supplier record. Changing bank details is the classic invoice-fraud vector — verify the request out of band before applying it. #### Signature ```http POST /business-made/vendors/update (body) -> The updated vendor ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Notes - Verify bank detail changes through a known contact, not the request that asked for them. #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `400` | — | sk (the vendor id) is required | The body has no `sk`. | — | | `404` | — | Vendor not found | No vendor has that `sk`. | — | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/vendors/{id}` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Request body The vendor to update. ```json { "id": "VEN-4821", "paymentTermsDays": 45 } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated vendor | | `400` | sk (the vendor id) is required — The body has no `sk`. | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Vendor not found — No vendor has that `sk`. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |