Changes a partner with a JSON merge patch: members not sent keep their stored value.
OAuth2 client-credentials flow for machine-to-machine access.
Exchange a client id/secret at /dw/register/oauth/token for a bearer token, then send it
as Authorization: Bearer <access_token>. Client credentials are provisioned in the
Lobster administration UI.
This is the client-credentials token endpoint of the Platform API. /oauth/token, the
token_endpoint advertised at /.well-known/oauth-authorization-server, serves the authorization
code flow of the OAuth2AuthorizationCode scheme.
OAuth 2.1 authorization code flow with PKCE, for acting as a signed-in user. It works with Microsoft and other single sign-on providers: the provider only confirms the user's identity to the platform, which then issues its own token.
POST /oauth/register(no authentication) with the JSON body{"redirect_uris": ["<redirect URI>"]}returns aclient_id. The user's browser has to reach the redirect URI.- Open
/oauth/authorizein the user's browser withresponse_type=code,client_id,redirect_uri,stateand acode_challengewithcode_challenge_method=S256.stateis a fresh unguessable value per request, andcode_challengeis the S256 hash of acode_verifierfreshly generated per request from a cryptographically secure random source (43 to 128 characters, RFC 7636). The user signs in on the platform's login page, and the browser is redirected to the redirect URI withcodeandstate; a callback whosestatediffers from the one sent is to be rejected. - The code is valid for 30 seconds. Exchange it at
POST /oauth/token, form-encoded, withgrant_type=authorization_code,code,redirect_uri,code_verifierandclient_id. - The answer carries
access_token(valid 30 minutes),refresh_token(valid 48 hours) andexpires_inin milliseconds. Refresh withgrant_type=refresh_token,refresh_tokenandclient_id.
Bearer token obtained from an authenticated browser or guest-user session.
Flow 1 — UI login: Log in via the Lobster web UI at /, then call
GET /auth/sessionBearerToken to exchange the session cookie for a bearer token.
Flow 2 — Guest user login token: Append a GuestUser loginToken as a URL
query parameter to the base URL to establish a password-free session:
GET <host>?loginToken=<GuestUser token>
Then call GET /auth/sessionBearerToken to obtain the bearer token.
The partner's id, as returned by list and create.
Partial update following JSON Merge Patch (RFC 7396). Send only the fields to change; omitted fields are left unchanged and an explicit null clears a field. What a clear reaches depends on the resource. Where the value is carried onto an underlying configuration, the field is reset to what a freshly built configuration holds for it rather than to absent, since that configuration has no representation for unset; where the absence cannot be stored at all, the null is accepted and the stored value is kept. A field the resource fills by resolving a reference keeps what is stored whenever the reference cannot be read back, a null being indistinguishable there from a lookup the session was not allowed to make. Requires Content-Type: application/merge-patch+json (sending application/json is rejected with HTTP 415). Control keys steer the merge and are spelled as a namespace prefix, a $ and the marker — the JSON form of the import vocabulary's core:mode. core$mode=overwrite, on the body or on any object inside it, resets the members that object did not send; a read-only member is not reset, since a marker cannot clear what a value could not set. An overwrite therefore has to carry every member the resource requires — its name among them — because omitting one asks for a record the store cannot accept. A reset is bound by the same limits an explicit null has, and those differ by resource: where the value is carried onto an underlying configuration the member goes back to what a freshly built one holds, and where the absence cannot be stored at all the member is kept rather than reset — so an overwrite is not a way to clear what a null could not. Nor does it remove a nested object the resource does not store separately: omitting a profile's inputAgentSettings under an overwrite does not remove the input agent, because a profile without one is not a state the store can hold. Send the nested object to reset inside it. core$mode=noResolve, likewise inherited by everything nested in it, matches nothing against the stored record, so the collections it covers are replaced, and a core$index or core$delete anywhere below it is rejected with 400 rather than passed over. core$index is a zero-based position in the stored list, sent as a number or its string form: the array element carrying it is merged into that stored element instead of replacing the list, and core$delete=true on the same element removes that position instead. Both steer an element of a list and are rejected with 400 anywhere else — on the body root, or on a member that holds a single object rather than a collection. Positions are counted in the list as it stood before the patch, so a core$delete earlier in the same array does not shift the entries a later core$index names, and the order of the elements does not matter. A core$index naming a position the list does not have, or whose stored element is of another type, is not honoured; the array then reads as an ordinary send. An element carrying core$delete=true is the exception: a delete steers the collection whether or not it matched anything, so an unhonoured one leaves the stored list exactly as it was rather than replacing it. An array no element of which carries an honoured marker replaces the stored collection, and [] clears it. An array that mixes steered and unmarked elements keeps the stored collection and adds the unmarked ones, so re-sending such a body adds them again — only an array whose every element is steered is idempotent. Outside a free-form map or property bag, whose keys are the caller's own and are stored verbatim however they are spelled, any other member spelling a $ is rejected with 400 — including a misspelled marker, a core$index that is not a whole number, a core$delete that is not true or false, a core$mode other than overwrite, noResolve or inherited, and any of the three carrying an object or an array as its value.
Rename the partner
An ordinary merge patch: every member not sent keeps its stored value.
{
"name": "ACME Logistics"
}Reset the members this body omits
Every member this body omits goes back to its default, as far as the record can store its absence — a member the API does not accept as input is never reset.
{
"core$mode": "overwrite",
"name": "ACME Logistics"
}Merge-patch form of core.IntegrationPartner: every member is optional; an overwrite (core$mode=overwrite) must still carry name.
The type of this object, always core.IntegrationPartner. Required where the member it is sent in accepts several types.
Contacts of the partner (people, not logins). null or left out keeps the stored contacts; a list replaces them: contacts not in the list are deleted, entries with a known id are updated, entries without one are created. Not carried on the partner embedded in a channel body.
A contact person (a person to reach, not a login): a partner's contacts are held in the partner's contacts member, the contact of a single channel in that channel's contact member.
The type of this object, always core.IntegrationPartnerContact. Required where the member it is sent in accepts several types.
E-mail addresses of the contact, one entry per address; in the stored form (comma-separated, display names quoted) they must fit 250 characters.
Fax number of the contact.
Id of the contact, assigned by the server. Ignored on create. On a partner update an id must be one of this partner's stored contact ids and updates that contact, left out creates a new one; on a channel update it must be the id of the channel's own contact, left out updates that contact.
Language of the contact, as stored by the platform; left out or blank, none is set.
Name of the contact person.
Free-text note about the contact.
Phone number of the contact.
Display name of the partner. Must be unique among all partners that are not deleted.
Name of the rate-limit policy for requests this partner sends to the platform's REST API and MCP endpoints through its HTTP channels; it applies when the HTTP channel itself names no policy. Global is built in; another name must reference an existing policy. Left out on create or blank, the partner has no policy; an explicit null keeps the stored value.
Whether the partner is in use. An explicit null keeps the stored value. DELETED cannot be written - delete the partner with DELETE instead.
Partner updated.
Standard Platform API success envelope. Every response carries exactly one of data (success) or error (failure) at top level.
A business party the platform exchanges data with. The partner itself holds only its name, status and rate-limit policy; its connections (logins, addresses, identifiers) are channels, managed under /platform/api/partners/preview/{partnerId}/channels, which profiles reference instead of the partner. {"name": "ACME Logistics"} is enough to create one; deleting a partner also deletes all its channels.
The type of this object, always core.IntegrationPartner. Required where the member it is sent in accepts several types.
Contacts of the partner (people, not logins). null or left out keeps the stored contacts; a list replaces them: contacts not in the list are deleted, entries with a known id are updated, entries without one are created. Not carried on the partner embedded in a channel body.
A contact person (a person to reach, not a login): a partner's contacts are held in the partner's contacts member, the contact of a single channel in that channel's contact member.
The type of this object, always core.IntegrationPartnerContact. Required where the member it is sent in accepts several types.
E-mail addresses of the contact, one entry per address; in the stored form (comma-separated, display names quoted) they must fit 250 characters.
Fax number of the contact.
Id of the contact, assigned by the server. Ignored on create. On a partner update an id must be one of this partner's stored contact ids and updates that contact, left out creates a new one; on a channel update it must be the id of the channel's own contact, left out updates that contact.
Language of the contact, as stored by the platform; left out or blank, none is set.
Name of the contact person.
Free-text note about the contact.
Phone number of the contact.
Numeric id of the partner, assigned by the server on create; it is the {partnerId} in the partner's URLs and its channels' URLs. A value sent in a body is ignored.
true when the partner is managed by the connected Trading Partner Manager (TPM). Such a partner and its channels cannot be deleted through this API. Set only by the TPM synchronisation; a value sent here is ignored.
Display name of the partner. Must be unique among all partners that are not deleted.
Name of the rate-limit policy for requests this partner sends to the platform's REST API and MCP endpoints through its HTTP channels; it applies when the HTTP channel itself names no policy. Global is built in; another name must reference an existing policy. Left out on create or blank, the partner has no policy; an explicit null keeps the stored value.
Whether the partner is in use. An explicit null keeps the stored value. DELETED cannot be written - delete the partner with DELETE instead.
The request could not be understood. BAD_REQUEST for a body that does not decode — its message names the property at fault — and VALIDATION_FAILED with one details entry per offending parameter for a malformed request target (an unknown query parameter or sort key). Also BAD_REQUEST for a response unit naming a channel this client cannot reference.
{
"error": {
"code": "BAD_REQUEST",
"message": "The request is invalid."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
Authentication is required or the supplied credentials are invalid.
{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication is required to access this resource."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
The caller lacks the permission for this operation on this resource (FORBIDDEN).
{
"error": {
"code": "FORBIDDEN",
"message": "Access to this resource is denied."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
The requested resource does not exist. The code is resource-specific, e.g. PARTNER_NOT_FOUND, PROFILE_NOT_FOUND or CHANNEL_NOT_FOUND.
{
"error": {
"code": "PARTNER_NOT_FOUND",
"message": "Partner not found: 42"
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
The request collides with the current state of the resource: a name already taken by another record, a lastModified that no longer matches because the record changed since it was read, or a delete the record's state refuses (it is open in the Lobster UI, still referenced by other objects, or managed by the Transport Manager). A field-level collision carries one details entry naming it.
{
"error": {
"code": "CONFLICT",
"message": "The request conflicts with the current state of the resource.",
"details": [
{
"code": "FIELD_INVALID",
"message": "A partner with the name 'ACME' already exists.",
"target": "name"
}
]
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
The body decoded but breaks a rule of the resource: a required member is missing, a value is not one of the accepted values or violates its pattern, length or range, a referenced id (partner, certificate, profile) does not exist, or two members contradict each other. One details entry per violation: FIELD_REQUIRED or FIELD_INVALID, with target naming the member path and message the rule, including the accepted values where there is a fixed set.
{
"error": {
"code": "VALIDATION_FAILED",
"message": "Request validation failed",
"details": [
{
"code": "FIELD_REQUIRED",
"message": "Field 'name' must not be empty.",
"target": "name"
}
]
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.
An unexpected server error occurred.
{
"error": {
"code": "INTERNAL_ERROR",
"message": "An unexpected error occurred."
}
}Standard Platform API error envelope: every failed request carries a single error object. Every response carries exactly one of data (success) or error (failure) at top level.
What went wrong: branch on its code, show its message, and read details for one entry per failed member.
Stable machine-readable UPPER_SNAKE error code for programmatic handling, e.g. PARTNER_NOT_FOUND, VALIDATION_FAILED or FORBIDDEN. New codes may be added over time; treat an unknown code according to the HTTP status class. The HTTP status itself is carried by the status line only, never duplicated here.
Human-readable, non-localized explanation. Branch on code, never on this text.
Individual failures within the request, e.g. one entry per violated field.
A single failure within the request.
Stable machine-readable UPPER_SNAKE code of this individual failure, e.g. FIELD_REQUIRED, FIELD_INVALID or VALUE_OUT_OF_RANGE.
Human-readable, non-localized explanation of this individual failure.
What this failure refers to, e.g. the violated field.