403 Forbidden when calling POST/GET on /pop_orders in Sage 200 Extra API

Solved

I’m integrating with the Sage 200 Extra API (v1, UK endpoint) to create and retrieve purchase orders, but every time I send a POST or GET request to

api.columbus.sage.com/.../pop_orders

I receive an HTTP 403 Forbidden response.

I’ve configured OAuth 2.0 correctly and included all required headers X-Site, X-Company and ocp-apim-subscription-key and verified the same token and headers work fine against the /suppliers endpoint.

Is there an additional header or API setting required specifically for the /pop_orders endpoints, or any extra steps to grant read/write access? Any guidance would be greatly appreciated.

  • +1
    verified answer

    You'll need to make sure that the API user has access to these features:

    Amend Purchase Order
    Enter New Purchase Order / New Purchase Order (Web Portal)
    View Purchase Order
    Amend Purchase Order Status

    Those are controlled by the Sage 200 Admin tool (so you may or may not have access and might need to get someone to set those up on your behalf)