POST
Mark a fulfillment shipped and hand it to a carrier

Authorizations

Authorization
string
header
required

A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.

Headers

Idempotency-Key
string
required

A unique key per logical write. Replaying a request with the same key returns the first response byte for byte instead of applying the write twice.

Path Parameters

fulfillmentId
string
required

Body

application/json

MAILS THE SHOPPER, every time, with no suppression path. Shipping a fulfillment that is not pending is refused with 409, so a retry cannot send a second notification. There is no route to correct a carrier or tracking number afterwards: the underlying statement writes both unconditionally, so a partial correction would erase the field it did not name.

carrier
string
required

Required. Placed verbatim in the shopper's shipped notification, so it is the carrier's name rather than a code.

tracking_number
string | null

Null means exactly what omitting it means: shipped with no tracking. The read publishes this field as null, so a client round-tripping that shape can send it straight back. Spelled tracking_number, not tracking, which is what the merchant API calls it.

Response

Success

data
object