Requisition orders
Download requisition headers as CSV
/a/RequisitionOrders_export
Stream a fixed-column CSV of active, visible requisition headers.
When to use this endpoint
Use the CRM1 requisition Export action. Configurable CRM2 exports use JSON selected-field rows instead.
Authentication and permissions
Authenticate with signed API-key fields or a logged-in CRM session. Session requests use dispatcher CSRF protection when configured. API keys use their owner’s identity.
The dispatcher requires explicit View on Requisition Order or Requisition Orders, even without a TeamAccess policy. API keys retain their owner’s permissions. Records are filtered to active headers within RequisitionOrder_scopeSQL: configured TeamAccess, or the legacy department boundary, including the owner exception for unlinked requisitions in the TeamAccess policy.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
daysTo | Integer-compatible relative days | No | Optional upper relative day; nonblank integer offsets include the complete selected server day. Blank/omission adds no upper bound. |
search | Text | No | Optional legacy substring search. The exact searched columns differ by export; LIKE wildcards retain meaning. |
roID | Integer-compatible | No | A nonzero integer adds an exact local requisition ID condition; zero is ignored. |
users / statuses | JSON array strings | No | Nonempty arrays add validated integer IN filters. Empty arrays, JSON null and non-array decoded scalars add no restriction; malformed JSON produces invalid users/statuses. List elements must be integer strings/numbers. |
description | Text | No | Nonblank lowercased description substring, escaped before querying. LIKE wildcards retain their meaning. |
referenceDateField / dateFromFilter / dateToFilter / isDateUnix | Allowlisted field / relative days / flag | No | Both relative day offsets plus a stored field enable an inclusive range, optionally converted from Unix time. Allowed fields: cdate, date_approved, delivery_date and id. Invalid names and malformed offsets are rejected. |
Example request
$csv = FM_api('RequisitionOrders_export', [
'daysFrom'=>'-30','daysTo'=>'0','search'=>'Materials',
'statuses'=>json_encode(['0','1']),
]);Example response
Id,User,Description,"Date Created","Delivery Date","Date Approved","Approved By","Linked To","Link Type",Notes,"Total Net","Total Tax","Carriage Net","Carriage Tax",Status,"Purchase Orders"
312,"Example user",Materials,"2026-11-05 09:00:00",,,,,,,25.00,5.00,10.00,2.00,Open,[]
The body is CSV rather than a JSON response. Dates/nulls and stored po_ids retain their persisted values.
Errors and unusual responses
| Response | Condition |
|---|---|
{"error":"not logged in"} | No authenticated tenant context is available. Invalid signed credentials can be rejected by the dispatcher before the handler runs. |
{"error": "permission denied"} | Requisition View is denied. |
{"error": "invalid users"} | users JSON or a nonempty integer list fails validation; statuses has the analogous error. |
{"error": "invalid referenceDateField: unsupported"} | The supplied reference field is outside the allowed export map. |
{"error":"permission denied"} | The required page permission is missing. Hidden/deleted records are omitted from collections; explicit parent readers reject an inaccessible parent. |
Legacy application errors may be returned with HTTP 200. Check the decoded response for error, not only the HTTP status.
Behaviour and edge cases
- Returns raw text/csv with attachment filename requisition_orders.csv and exits. No JSON envelope or pagination/cap. Active/scoped headers sort by local ID. Empty results still return the CSV header.
- Columns are Id, User, Description, Date Created, Delivery Date, Date Approved, Approved By, Linked To, Link Type, Notes, Total Net/Tax, Carriage Net/Tax, Status and Purchase Orders. User/approver IDs resolve to names; status becomes Open/Approved/Processed/Received/Cancelled.
- Stored total_net/total_tax are line aggregates, so carriage remains separate. po_ids remains its stored string; CSV quoting protects structural commas but does not decode that JSON text.
- Search matches assigned user name, description or ID substring. Relative creation dates and the optional reference-field range combine with AND. Related Contract/Customer/Department/Location names are looked up directly; Quote/Job targets display #ID.
- Builds the CSV in a request-local php://temp stream; concurrent exports do not overwrite one another’s file. raw, where supported, changes only the attachment header.
- Related names require their page View and record visibility. Missing/inaccessible names are blank; link type zero is blank. Description text is escaped before SQL.
Side effects
- Reads visible order data, writes CSV into a request-local temporary stream, sends download headers and exits. No shared tenant filename, order, stock or financial mutation.
See it in Fieldmotion
CRM1
The CRM1 export button is hidden when userdata.permissions bit 256 is set; the server guard requires Requisition View but does not check that export flag. In CRM1 Requisition Orders, click Export. Its POST form submits CSRF, daysFrom/daysTo and the current table search to RequisitionOrders_export.
CRM2
No direct CRM2 literal caller was found in the searched client source. CRM2 builds CSV from RequisitionOrders_getExportData.
Related endpoints
RequisitionOrders_getDataTable— Read a paged mapped collection.RequisitionOrders_getExportData— Read selected configurable export rows.RequisitionOrder_get— Read one checked requisition.