# Update a purchase order

Operation ID: `updatePurchaseOrder`

Group: Accounting › Purchase Orders

[Open in the interactive reference](https://docs.api.lensing.ai/lensing/v1/endpoints/updatePurchaseOrder)

`PATCH /accounting/purchase-orders/{id}`

Retry-safe: A write that accepts Idempotency-Key: repeating a request with the same key replays the stored answer instead of executing twice.

Updates a purchase order with the fields you send. A field you leave out keeps its current value.

Use the purchase order's id, not its poNumber.

Lines change through three separate arrays, applied in this order: deleteLines, updateLines, createLines. Lines you don't name stay as they are. Every update also removes the order's attachments and clears its bill-to and ship-to addresses, because this endpoint can't send them.

Every change sets approvalStatus and budgetStatus back to 'pendingApproval', even a change to the description. The order then goes through your tenant's approval policy again, which approves it at once when no approvers are configured.

The legal entity that owns the order can't be changed.

One request can remove a line and add its replacement.

updateLines and deleteLines name each line by the id that GET accounting/purchase-orders/:id returns for it. The order must keep at least one line.

The response is empty. To see the updated order, use GET accounting/purchase-orders/:id.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `Api-Version` | header | string · v1 | yes | The API version this request targets, named by its public identifier. Required on every request; omitting it, or naming a version this company does not have, is answered with 400. This document describes version `v1`. |
| `Idempotency-Key` | header | string | no | An opaque caller-chosen string (1-255 characters) that makes this request safe to retry. Repeating the same key with an identical request body replays the original response instead of re-executing - but only once that original request succeeded; a failed attempt re-executes on retry. Repeating the key with a different body is answered with 422. A key still in flight is answered with 409 - as is a key whose original request was interrupted before it finished, for a few minutes afterwards, until that attempt is presumed dead. A completed response stays replayable for 24 hours. The key is scoped to the caller, not to the action: reusing it for a different action is answered with 409 or 422 rather than treated independently. On read actions this header is ignored. On write actions that cannot offer the guarantee it is answered with `400 IDEMPOTENCY_NOT_SUPPORTED` rather than silently ignored. |
| `id` | path | string | yes | The unique identifier of the purchase order you want to update. Example: `"9c4e1b70-8d25-4a63-b19f-5e7c02da3846"`. |

## Request body

Required, `application/json`: updatePurchaseOrderInput.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `vendorId` | string | no | The vendor the order is placed with. See id on GET accounting/vendors/:id. Omit to leave unchanged. |
| `currency` | string | no | The currency of the order. Format ISO 4217, for example 'USD'. Governs every line amount. Omit to leave unchanged. |
| `description` | string | no | The description of the order, shown to the vendor. Omit to leave unchanged. |
| `internalDescription` | string | no | An internal description of the order, not shown to the vendor. Omit to leave unchanged. |
| `externalMemo` | string | no | A memo printed on vendor-facing documents. Omit to leave unchanged. |
| `externalPONumber` | string | no | The reference number this order has in the upstream system. Omit to leave unchanged. |
| `paymentTerms` | string | no | The payment-terms code agreed with the vendor, for example 'net30'. Omit to leave unchanged. |
| `startDate` | date | no | The date the order starts. Use format YYYY-MM-DD. Omit to leave unchanged. |
| `endDate` | date | no | The date the order ends. Use format YYYY-MM-DD. Omit to leave unchanged. |
| `needByDate` | date | no | The date the goods or services are required by. Use format YYYY-MM-DD. Omit to leave unchanged. Example: `"2026-11-01"`. |
| `requestedById` | string | no | The employee who requested the order. There is no endpoint for it. Omit to leave unchanged. |
| `createLines` | array<object> | no | Lines to add to this order, in the same shape as on create but with no id. Omit for no additions. |
| `createLines[].isItem` | boolean | yes | Whether this is an item line. True for an item line, priced by quantity times price. False for an expense line, priced by editableAmount. |
| `createLines[].description` | string | no | A description of what is being ordered. |
| `createLines[].itemId` | string | no | The item being ordered. Expected on an item line. |
| `createLines[].accountId` | string | no | The ledger account the line is booked to. See id on GET accounting/accounts/:id. Expected on an expense line. |
| `createLines[].unitOfMeasureId` | string | no | The unit the quantity is expressed in. Expected on an item line. |
| `createLines[].departmentId` | string | no | The department the cost is allocated to. See id on GET people/departments/:id. |
| `createLines[].quantity` | decimal | no | The ordered quantity, as a decimal. Expected on an item line. |
| `createLines[].price` | decimal | no | The unit price, in the order currency, as a decimal. Expected on an item line. |
| `createLines[].editableAmount` | decimal | no | The manually entered line amount, in the order currency, as a decimal. Expected on an expense line. |
| `createLines[].startDate` | date | no | The date this line starts. Use format YYYY-MM-DD. |
| `createLines[].endDate` | date | no | The date this line ends. Use format YYYY-MM-DD. |
| `createLines[].estimatedDeliveryDate` | date | no | The expected delivery date for this line. Use format YYYY-MM-DD. |
| `updateLines` | array<object> | no | Lines to change, each addressed by the id the order publishes. Every field but the id is optional and omit leaves it unchanged. Omit for no changes. Example: `[{"id":"7a1b2c3d-4e5f-6071-8293-a4b5c6d7e8f9","editableAmount":"520.00"}]`. |
| `updateLines[].id` | string | yes | The unique identifier for the line to change. It must belong to this order. |
| `updateLines[].isItem` | boolean | no | Whether this is an item line. Omit to leave unchanged. |
| `updateLines[].description` | string | no | A description of what is being ordered. Omit to leave unchanged. |
| `updateLines[].itemId` | string | no | The item being ordered. Omit to leave unchanged. |
| `updateLines[].accountId` | string | no | The ledger account the line is booked to. See id on GET accounting/accounts/:id. Omit to leave unchanged. |
| `updateLines[].unitOfMeasureId` | string | no | The unit the quantity is expressed in. Omit to leave unchanged. |
| `updateLines[].departmentId` | string | no | The department the cost is allocated to. See id on GET people/departments/:id. Omit to leave unchanged. |
| `updateLines[].quantity` | decimal | no | The ordered quantity, as a decimal. Omit to leave unchanged. |
| `updateLines[].price` | decimal | no | The unit price, in the order currency, as a decimal. Omit to leave unchanged. |
| `updateLines[].editableAmount` | decimal | no | The manually entered line amount, in the order currency, as a decimal. Omit to leave unchanged. |
| `updateLines[].startDate` | date | no | The date this line starts. Use format YYYY-MM-DD. Omit to leave unchanged. |
| `updateLines[].endDate` | date | no | The date this line ends. Use format YYYY-MM-DD. Omit to leave unchanged. |
| `updateLines[].estimatedDeliveryDate` | date | no | The expected delivery date for this line. Use format YYYY-MM-DD. Omit to leave unchanged. |
| `deleteLines` | array<string> | no | The identifiers of the lines to remove, applied before the updates and creates. Each must belong to this order. Removing them all is refused, so delete the order instead. |

```json
{
  "vendorId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "currency": "<currency>",
  "description": "<description>",
  "internalDescription": "<internalDescription>",
  "externalMemo": "<externalMemo>",
  "externalPONumber": "<externalPONumber>",
  "paymentTerms": "<paymentTerms>",
  "startDate": "2026-01-15",
  "endDate": "2026-01-15",
  "needByDate": "2026-11-01",
  "requestedById": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "createLines": [
    {
      "isItem": true,
      "description": "<description>",
      "itemId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "accountId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "unitOfMeasureId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "departmentId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "quantity": "19.99",
      "price": "19.99",
      "editableAmount": "19.99",
      "startDate": "2026-01-15",
      "endDate": "2026-01-15",
      "estimatedDeliveryDate": "2026-01-15"
    }
  ],
  "updateLines": [
    {
      "id": "7a1b2c3d-4e5f-6071-8293-a4b5c6d7e8f9",
      "editableAmount": "520.00"
    }
  ],
  "deleteLines": [
    "<deleteLines>"
  ]
}
```

## Response

`200` Success

```json
{
  "data": {},
  "diagnostics": [
    {
      "code": "<code>",
      "message": "<message>",
      "severity": "error",
      "path": [
        "<path>"
      ],
      "details": "<details>"
    }
  ]
}
```

## Response headers

- `Idempotency-Replayed` — Present and `true` only when this response replays a previously stored one for the same Idempotency-Key, rather than reflecting a live execution. Absent on a live response - never sent as `false`.

## Errors

| Code | Status |
| --- | --- |
| `NOT_FOUND` | 400 |
| `REFERENCE_NOT_FOUND` | 400 |
| `LINE_NOT_FOUND` | 400 |
| `NO_LINES` | 400 |
| `TOO_MANY_LINES` | 400 |
| `IDEMPOTENCY_KEY_CONFLICT` | 409 |
| `IDEMPOTENCY_PAYLOAD_MISMATCH` | 422 |

## Statuses

- `400` — Invalid request or business failure. Codes: NOT_FOUND, REFERENCE_NOT_FOUND, LINE_NOT_FOUND, NO_LINES, TOO_MANY_LINES
- `401` — The request carries no valid access token.
- `403` — Not authorized
- `404` — Not found
- `409` — The Idempotency-Key is still being processed by another request.
- `422` — The Idempotency-Key was already used with a different request payload.
- `429` — Too many requests from this client address. The response has no body and no `Retry-After` header.
- `500` — Internal server error