ConfirmPO API

Authentication

Create an API key at zbackroom.com/account — the same account you sign in to ConfirmPO with. Send it as a bearer token on every request:

Authorization: Bearer zbk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys aren't shown again after creation — if you lose one, revoke it and create a new one. Requests without a valid key get a 401.

API keys are secrets. Use them from server-side applications or secure automation environments — do not embed one in frontend JavaScript that gets shipped to users, since anyone viewing the page source could extract and reuse it.

Base URL

https://confirmpo.zbackroom.com/api/v1

Open CORS (callable from any origin) — that's about which pages can send the request, not who can send it as you. The bearer key above is still what actually authenticates a request, so keep it out of code that runs in someone else's browser.

Rate limits

Per API key: POST /pos — 100/hour. GET requests (list and detail combined) — 1,000/hour. Over the limit gets a 429 with a Retry-After header (seconds until the window resets).

POST /pos — create and send a PO

Creates a purchase order and immediately emails the supplier a confirmation link.

curl https://confirmpo.zbackroom.com/api/v1/pos \
  -H "Authorization: Bearer zbk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "poNumber": "PO-38491",
    "supplierName": "Acme Parts Co.",
    "supplierEmail": "orders@acmeparts.com",
    "note": "Please confirm by Friday.",
    "lines": [
      { "partNumber": "Widget A", "qty": 500, "price": 2.10, "dueDate": "2026-10-15" },
      { "partNumber": "Widget B", "qty": 200, "price": 4.80, "dueDate": "2026-10-15" }
    ],
    "charges": [
      { "label": "Shipping", "amount": 25.00 },
      { "label": "Tax", "amount": 41.60 }
    ]
  }'

Response — 201:

{
  "id": "cmu5...",
  "poNumber": "PO-38491",
  "status": "SENT",
  "createdAt": "2026-09-17T16:00:00.000Z",
  "url": "https://confirmpo.zbackroom.com/po/cmu5..."
}

lines[].dueDate must be YYYY-MM-DD. Counts against your plan's PO limit the same as creating one in the dashboard — a 402 means you've hit it. charges is optional — shipping, tax, or anything else with a flat amount added to the order total; omit it or pass an empty array for none.

GET /pos — list your POs

POs you created, or ones sent to your account's email as the supplier.

curl https://confirmpo.zbackroom.com/api/v1/pos \
  -H "Authorization: Bearer zbk_..."

Response — 200:

{
  "data": [
    {
      "id": "cmu5...",
      "poNumber": "PO-38491",
      "supplierName": "Acme Parts Co.",
      "supplierEmail": "orders@acmeparts.com",
      "status": "SENT",
      "lineCount": 2,
      "exceptionCount": 0,
      "createdAt": "2026-09-17T16:00:00.000Z",
      "lastSentAt": "2026-09-17T16:00:00.000Z",
      "submittedAt": null
    }
  ]
}

GET /pos/:id — get a PO's status and line-level detail

curl https://confirmpo.zbackroom.com/api/v1/pos/cmu5... \
  -H "Authorization: Bearer zbk_..."

Response — 200:

{
  "id": "cmu5...",
  "poNumber": "PO-38491",
  "supplierName": "Acme Parts Co.",
  "supplierEmail": "orders@acmeparts.com",
  "status": "SUBMITTED",
  "note": "Please confirm by Friday.",
  "currentVersion": 1,
  "createdAt": "2026-09-17T16:00:00.000Z",
  "lastSentAt": "2026-09-17T16:00:00.000Z",
  "submittedAt": "2026-09-17T18:30:00.000Z",
  "lines": [
    {
      "id": "cku1...",
      "lineNo": 1,
      "partNumber": "Widget A",
      "description": null,
      "orderedQty": 500,
      "orderedPrice": 2.1,
      "orderedDueDate": "2026-10-15",
      "action": "CHANGE",
      "confirmedQty": 450,
      "confirmedPrice": 2.1,
      "confirmedDueDate": "2026-10-20",
      "buyerDecision": "PENDING"
    }
  ],
  "charges": [
    { "id": "cke1...", "label": "Shipping", "amount": 25.0 }
  ]
}

action is null until the supplier responds, then ACCEPT or CHANGE. buyerDecision (PENDING / ACCEPTED / REJECTED / CONTACT_SUPPLIER) only matters on CHANGE lines — it's your call on their proposed change, made from the PO page in the dashboard. A PO you have no access to returns 404, same as one that doesn't exist.

What's not in v1

Resending an updated PO, adding comments, and recording a buyer decision on a changed line are dashboard-only for now — reachable from a PO's page at confirmpo.zbackroom.com/po/:id.