Contents

Stock

Absolute stock levels per item, warehouse location code and classification. Send everything or only what changed: items you do not send keep their last level. Report stock net of the orders you have accepted; Nucleo subtracts the orders you have not accepted yet before publishing availability to the sales channels.

Base URL, authentication and conventions of this API are on the Fulfillment API page.

put/stock

Update stock levels

Absolute levels (not increments) per item, location code and classification, at most 500 items per call (the merchant can set a different limit; above it nothing is processed and the answer is 422 too_many_items: split the update in batches).

  • Identify each item by sku or barcode.
  • location_code is one of the stock_location_codes returned by Ping. It can be omitted when your connection has a single code.
  • classification defaults to sellable; only sellable stock is published as available to the sales channels. Other classifications are stored and, if the merchant chooses so, published as damaged (not sellable) stock.
  • counted_at: when the level was counted; without it, the time Nucleo receives the call. A level older than the last one applied for the same item, location code and classification is not applied and is listed in ignored with reason stale, so late retries cannot roll stock back.

Unknown items are ignored (listed in ignored with reason unknown_item, and the merchant is alerted); the others are applied and counted in accepted. A location code not linked to a Nucleo location yet is saved but not published, and listed in warnings. Validation errors (400) reject the whole call.

PUT https://api-commerce.nucleoplatform.com/api/fulfillment/v1/stock
Authentication: Bearer token
Rate limit: 600 requests per 1m, per connection — Default limit; the merchant can set another one on the connection.

Headers

  • Idempotency-Keystring

    Any unique string you generate (1–255 printable ASCII characters, no spaces), for example a UUID. For 48 hours, the same key with the same request — same method, same path written the same way (/orders/1042 and /orders/%231042 differ) and same body — returns the stored answer without doing the work again (header Idempotent-Replayed: true; the replayed body keeps the original request_id, the X-Request-Id header is the new call's). The same key with a different request answers 409 idempotency_key_reused; while the first request is still running, 409 idempotency_key_in_progress. A key left in progress for more than 2 minutes (an interrupted call) is free again. Keys are per connection. Server errors (5xx) and 429 are not stored: retry them with the same key.

    max length 255
    Example: 2f0c9a1e-6b4d-4f3a-9e7c-5d1b8a2c4e6f

Request bodyapplication/json

  • itemsarray of ItemRef & objectrequired
    min items 1max items 500
    Attributes of each item
    • skustring | null
      max length 255
    • barcodestring | null
      max length 255
    • location_codestring | null

      Required when your connection has more than one stock location code.

      max length 40
    • quantityintegerrequired

      Absolute level, not an increment.

      min 0
    • classificationstring
      One ofsellabledamagedquarantinereservedunsellable
      default sellable
    • counted_atstring (date-time) | null

Responses

  • 200Levels applied.
    Headers
    • X-Request-Id Identifier of the call. Quote it when you contact support; it is also error.request_id.
    • acceptedinteger

      Items applied.

    • ignoredarray of object
      Attributes of each item
      • indexinteger

        Position in items, from 0.

      • skustring | null
      • barcodestring | null
      • reasonstring

        unknown_item: not in the catalog. stale: counted_at older than the level already applied.

        One ofunknown_itemstale
    • warningsarray of object
      Attributes of each item
      • location_codestring
      • reasonstring
        One oflocation_not_mapped
      • messagestring
  • 400The request is not valid: validation_failed (with details per field), invalid_json, invalid_cursor. Nothing was changed.
    Headers
    • X-Request-Id Identifier of the call. Quote it when you contact support; it is also error.request_id.
    • errorobjectrequired
      Child attributes
      • codestringrequired

        Stable, machine-readable code. Branch on it, not on message.

        One ofvalidation_failedinvalid_jsoninvalid_cursorunauthorizedconnection_pausedconnection_not_activenot_foundmethod_not_allowedorder_not_foundreturn_not_foundorder_not_readyorder_not_acceptedorder_already_acceptedorder_cancelledorder_cancel_requestedorder_already_shippedinvalid_statedocuments_not_readylabels_not_readyidempotency_key_reusedidempotency_key_in_progresspayload_too_largeunknown_itemtoo_many_itemslabels_not_enabledrate_limitedinternal_error
      • messagestringrequired

        Explanation in English for people. It can change; never parse it.

      • request_idstring (uuid)required

        Same as the X-Request-Id header.

      • detailsobject

        Validation and item errors per field: {"lines.0.quantity": ["…"]}.

  • 401Missing or invalid API key (unauthorized).
    Headers
    • X-Request-Id Identifier of the call. Quote it when you contact support; it is also error.request_id.
    • errorobjectrequired
      Child attributes
      • codestringrequired

        Stable, machine-readable code. Branch on it, not on message.

        One ofvalidation_failedinvalid_jsoninvalid_cursorunauthorizedconnection_pausedconnection_not_activenot_foundmethod_not_allowedorder_not_foundreturn_not_foundorder_not_readyorder_not_acceptedorder_already_acceptedorder_cancelledorder_cancel_requestedorder_already_shippedinvalid_statedocuments_not_readylabels_not_readyidempotency_key_reusedidempotency_key_in_progresspayload_too_largeunknown_itemtoo_many_itemslabels_not_enabledrate_limitedinternal_error
      • messagestringrequired

        Explanation in English for people. It can change; never parse it.

      • request_idstring (uuid)required

        Same as the X-Request-Id header.

      • detailsobject

        Validation and item errors per field: {"lines.0.quantity": ["…"]}.

  • 403The connection is paused (connection_paused) or not active yet (connection_not_active). Nothing was read or changed: retry later.
    Headers
    • X-Request-Id Identifier of the call. Quote it when you contact support; it is also error.request_id.
    • errorobjectrequired
      Child attributes
      • codestringrequired

        Stable, machine-readable code. Branch on it, not on message.

        One ofvalidation_failedinvalid_jsoninvalid_cursorunauthorizedconnection_pausedconnection_not_activenot_foundmethod_not_allowedorder_not_foundreturn_not_foundorder_not_readyorder_not_acceptedorder_already_acceptedorder_cancelledorder_cancel_requestedorder_already_shippedinvalid_statedocuments_not_readylabels_not_readyidempotency_key_reusedidempotency_key_in_progresspayload_too_largeunknown_itemtoo_many_itemslabels_not_enabledrate_limitedinternal_error
      • messagestringrequired

        Explanation in English for people. It can change; never parse it.

      • request_idstring (uuid)required

        Same as the X-Request-Id header.

      • detailsobject

        Validation and item errors per field: {"lines.0.quantity": ["…"]}.

  • 409The request conflicts with the current state: order_not_ready, order_not_accepted, order_already_accepted, order_cancelled, order_cancel_requested, order_already_shipped, invalid_state, documents_not_ready, labels_not_ready; or with an Idempotency-Key: idempotency_key_reused, idempotency_key_in_progress (with Retry-After). Read the order or return again before retrying.
    Headers
    • X-Request-Id Identifier of the call. Quote it when you contact support; it is also error.request_id.
    • Retry-After Seconds to wait before retrying.
    • errorobjectrequired
      Child attributes
      • codestringrequired

        Stable, machine-readable code. Branch on it, not on message.

        One ofvalidation_failedinvalid_jsoninvalid_cursorunauthorizedconnection_pausedconnection_not_activenot_foundmethod_not_allowedorder_not_foundreturn_not_foundorder_not_readyorder_not_acceptedorder_already_acceptedorder_cancelledorder_cancel_requestedorder_already_shippedinvalid_statedocuments_not_readylabels_not_readyidempotency_key_reusedidempotency_key_in_progresspayload_too_largeunknown_itemtoo_many_itemslabels_not_enabledrate_limitedinternal_error
      • messagestringrequired

        Explanation in English for people. It can change; never parse it.

      • request_idstring (uuid)required

        Same as the X-Request-Id header.

      • detailsobject

        Validation and item errors per field: {"lines.0.quantity": ["…"]}.

  • 413The body is larger than 5 MB (payload_too_large). Nothing was read.
    Headers
    • X-Request-Id Identifier of the call. Quote it when you contact support; it is also error.request_id.
    • errorobjectrequired
      Child attributes
      • codestringrequired

        Stable, machine-readable code. Branch on it, not on message.

        One ofvalidation_failedinvalid_jsoninvalid_cursorunauthorizedconnection_pausedconnection_not_activenot_foundmethod_not_allowedorder_not_foundreturn_not_foundorder_not_readyorder_not_acceptedorder_already_acceptedorder_cancelledorder_cancel_requestedorder_already_shippedinvalid_statedocuments_not_readylabels_not_readyidempotency_key_reusedidempotency_key_in_progresspayload_too_largeunknown_itemtoo_many_itemslabels_not_enabledrate_limitedinternal_error
      • messagestringrequired

        Explanation in English for people. It can change; never parse it.

      • request_idstring (uuid)required

        Same as the X-Request-Id header.

      • detailsobject

        Validation and item errors per field: {"lines.0.quantity": ["…"]}.

  • 422Valid JSON that cannot be applied: unknown_item (an item that is not on the order or not known, with details per line), too_many_items, labels_not_enabled. Nothing was changed.
    Headers
    • X-Request-Id Identifier of the call. Quote it when you contact support; it is also error.request_id.
    • errorobjectrequired
      Child attributes
      • codestringrequired

        Stable, machine-readable code. Branch on it, not on message.

        One ofvalidation_failedinvalid_jsoninvalid_cursorunauthorizedconnection_pausedconnection_not_activenot_foundmethod_not_allowedorder_not_foundreturn_not_foundorder_not_readyorder_not_acceptedorder_already_acceptedorder_cancelledorder_cancel_requestedorder_already_shippedinvalid_statedocuments_not_readylabels_not_readyidempotency_key_reusedidempotency_key_in_progresspayload_too_largeunknown_itemtoo_many_itemslabels_not_enabledrate_limitedinternal_error
      • messagestringrequired

        Explanation in English for people. It can change; never parse it.

      • request_idstring (uuid)required

        Same as the X-Request-Id header.

      • detailsobject

        Validation and item errors per field: {"lines.0.quantity": ["…"]}.

  • 429rate_limited: more calls in a minute than the connection allows (600 by default, all endpoints together; the merchant can set another limit), or too many failed authentications from your IP. Wait the seconds in Retry-After.
    Headers
    • X-Request-Id Identifier of the call. Quote it when you contact support; it is also error.request_id.
    • Retry-After Seconds to wait before retrying.
    • errorobjectrequired
      Child attributes
      • codestringrequired

        Stable, machine-readable code. Branch on it, not on message.

        One ofvalidation_failedinvalid_jsoninvalid_cursorunauthorizedconnection_pausedconnection_not_activenot_foundmethod_not_allowedorder_not_foundreturn_not_foundorder_not_readyorder_not_acceptedorder_already_acceptedorder_cancelledorder_cancel_requestedorder_already_shippedinvalid_statedocuments_not_readylabels_not_readyidempotency_key_reusedidempotency_key_in_progresspayload_too_largeunknown_itemtoo_many_itemslabels_not_enabledrate_limitedinternal_error
      • messagestringrequired

        Explanation in English for people. It can change; never parse it.

      • request_idstring (uuid)required

        Same as the X-Request-Id header.

      • detailsobject

        Validation and item errors per field: {"lines.0.quantity": ["…"]}.

Request
curl -X PUT https://api-commerce.nucleoplatform.com/api/fulfillment/v1/stock \
  -H "Authorization: Bearer $NUCLEO_ACCESS_TOKEN" \
  -H 'Idempotency-Key: 2f0c9a1e-6b4d-4f3a-9e7c-5d1b8a2c4e6f' \
  -H 'Content-Type: application/json' \
  -d '{
  "items": [
    {
      "sku": "TEE-BLK-M",
      "quantity": 42,
      "counted_at": "2026-10-13T06:00:00Z"
    },
    {
      "barcode": "2000000000022",
      "location_code": "VR1",
      "quantity": 3,
      "classification": "damaged"
    },
    {
      "sku": "SOCK-WHT-S",
      "quantity": 0
    }
  ]
}'
Response
{
  "accepted": 2,
  "ignored": [
    {
      "index": 2,
      "sku": "SOCK-WHT-S",
      "barcode": null,
      "reason": "unknown_item"
    }
  ],
  "warnings": []
}
Was this page helpful?