Submit resale orders to FHC programmatically.

Replace $TOKEN with the API key delivered to you by FHC out-of-band. The token format is tok_<customer_id>.<secret> and is scoped to a single FHC customer account — you cannot place orders on behalf of a different customer.

request.shcurl -X POST https://api4.fhchardware.com/v1/orders \
  -H "X-API-Key: $TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-Idempotency-Key: po-12345-attempt-1" \
  -d '{
    "REC": {
      "SHIP_TO_FNAME":   "Jane",
      "SHIP_TO_LNAME":   "Doe",
      "SHIP_TO_ADDRESS": "123 Main St",
      "SHIP_TO_CITY":    "Charlotte",
      "SHIP_TO_STATE":   "NC",
      "SHIP_TO_ZIP":     "28202",
      "SHIP_TO_COUNTRY": "US",
      "PURCHASE_ORDER":  "PO-12345",
      "ORDER_LINES": [
        { "PRODUCT_CODE": "HP2X6SSS", "ORDER_QUANTITY": 4 }
      ]
    }
  }'

A successful call returns HTTP 200 with the D3 order number:

200 OK{
  "order_number": "918845",
  "customer_number": 46813,
  "status": "created"
}

See the full schema for every field and all optional fields (JOB_NAME, SHIP_VIA, LOC, and others). Carrier and warehouse code values are on the Codes page.

Every request must include an X-API-Key header. The token is issued by FHC in the form:

tok_<customer_id>.<secret>

Customer injection is enforced server-side. The customer ID bound to your token is the customer the order will be created under. Do not include a CUSTOMER_NUMBER field in your request body — any value supplied is ignored.

Tokens are delivered once via a secure out-of-band channel. They are stored hashed on our side and cannot be recovered — only rotated. If you lose a secret, contact FHC to rotate; the old value is invalidated immediately on rotation.

HTTP 400 means the request was rejected — either the JSON was malformed or D3 rejected it on a business rule (inactive customer, unknown product code, etc.). HTTP 5xx means the request didn't reach completion; retry with the same idempotency key is safe.