Suppliers

Full CRUD on suppliers. This is the buyer-side supplier record: from a client's perspective, the supplier. Whether a record is backed by one of Hivebuy's integrated suppliers is never exposed: no field, no filter. The one place it shows through is DELETE, which is refused with 400 for a backed record.

What you cannot write

The eight assigned* visibility fields (users, departments, legal entities, roles, each with an …Allowed flag that inverts its gate) are readable so an integration can see the rules, and read-only so it cannot hide a supplier from everyone. files and budgets are read-only too. assignedCategories and assignedCategoriesAllowed are writable, categories are not a visibility gate.

What is never exposed

Credentials and punchout identity, in neither direction and under no parameter: secret key, password, login ids, search credentials, cXML identities and domains, party id, and the punchout, confirmation, delivery, e-invoice and integrated-search URLs. No punchout actions are mirrored either.

Two deliberate differences from the in-app list: unlisted suppliers are returned, and results are not narrowed to what the key user may see.

Operations

Reads need master-data:read, writes master-data:write.

• GET/api/v2/{companyId}/suppliers/: Paginated by name, unlisted suppliers included.
• POST/api/v2/{companyId}/suppliers/: name is required. Relations (contract, tags, categories, responsible user, and the ones inside companySupplierLegalEntities) must belong to, or be active in, this company.
• GET/api/v2/{companyId}/suppliers/{id}/: One supplier. Soft-deleted rows are returned here too.
• PUT/api/v2/{companyId}/suppliers/{id}/: Replaces the writable fields; the visibility fields, files and budgets are untouched.
• PATCH/api/v2/{companyId}/suppliers/{id}/: Changes only what you send. To change one legal-entity override, send that entry with its id.
• DELETE/api/v2/{companyId}/suppliers/{id}/: Soft delete, unless the record is backed by an integrated supplier, which is refused with 400 actionNotAllowed.
• POST/api/v2/{companyId}/bulk-upsert/suppliers/: Bulk upsert, up to 50 rows, matched by id, name, supplierNumber, then externalSupplierNumber. The Suppliers field policy applies: no credentials, no punchout identity, visibility fields not writable. Shared rules under Bulk upserts in the Introduction.