When to use this endpoint

Use for the legacy supplier selector. The list offers non-held suppliers, but the handler does not reproduce that selector filter.

Authentication and permissions

Authenticate with signed API-key fields or a logged-in CRM session. Session requests use dispatcher CSRF protection when configured.

Requires explicit View on Purchase Order or Purchase Orders. Writes also require the matching Edit permission; clearing invoice details requires Delete. A non-administrator blocked by the legacy Purchase Orders visibility flag (crm_access bit 256) is denied. API keys use their owner’s permissions.

The primary order is checked against the current tenant and Purchase Order record scope. Configured TeamAccess follows permitted linked Contracts, Customers, Jobs, Quotes and Departments; the legacy department filter follows direct Customer/Quote/customer-Job links. An inaccessible or missing order returns purchase order does not exist.

Parameters

ParameterTypeRequiredDescription
idInteger-compatibleYesPositive local Purchase Order ID/digit string; not the displayed po_num. Missing, malformed or inaccessible IDs fail.
supplier_idInteger-compatibleYesPositive supplier ID. Requires an available supplier and Suppliers View; zero/negative/unknown IDs are rejected.

Example request

$result = FM_api('PurchaseOrder_setSupplier', [
	'id'=>'1042',
	'supplier_id'=>'72',
]);

Example response

{
  "ok": 1
}

Errors and unusual responses

ResponseCondition
{"error":"not logged in"}No authenticated tenant context is available. Invalid signed credentials can be rejected by the dispatcher before the handler runs.
{"error": "no ID provided"}id absent/null.
{"error": "no supplier id provided"}supplier_id absent/null.
{"error": "permission denied"}The required page/action or legacy visibility setting denies access.
{"error": "purchase order does not exist"}The primary order is missing or outside the caller’s permitted scope.
{"error": "supplier does not exist or is not available"}The supplier is unavailable, held or not visible.

Legacy application errors may be returned with HTTP 200. Check the decoded response for error, not only the HTTP status.

Behaviour and edge cases

  • The replacement must be a positive, existing, non-deleted, non-held supplier accessible through Suppliers View. Missing/held references fail before writing.
  • Only the header relationship changes; existing line prices and stock allocations are not rewritten. Later reads show current supplier data.
  • Changing supplier, carriage amounts/code or line items clears date_approved and requires approval again. Exact no-op saves retain approval. The legacy approved-edit restriction (crm_access bit 8192) is still enforced for non-administrators. Sent history is retained.

Side effects

  • Header writes lock the existing order and tenant owner, check persistence and record history in the same transaction. Errors roll back the header and audit; a true no-op returns {ok:1,warning:"no change needed"} without a new event/history entry. Cache invalidation and edit-event follow-ups run after the owning transaction commits; an event exception returns saved=1 and a no-replay warning.
  • A changed header emits PurchaseOrder_edit after commit; configured account listeners may perform integration work. No order email/PDF is sent directly by this route.

See it in Fieldmotion

CRM1

In the CRM1 Purchase Orders list, click a supplier cell and select a replacement. The selector loads Suppliers_list(on_hold=0), then calls PurchaseOrder_setSupplier.

CRM2

No direct caller was found in CRM2 source. Its Purchase Order screen uses mapped reads and generic field saves rather than this legacy endpoint.

Related endpoints