{"activeVersionTag":"latest","latestAvailableVersionTag":"latest","collection":{"info":{"_postman_id":"473f3ed8-7306-464c-98bb-48b8b39c0469","name":"Helm 3.6","description":"# Helm v3.6 — Public API\n\n_Last updated: 22 October 2026_\n\n_Helm is The Despatch Company's order, inventory and despatch platform._\n\nThis collection documents every endpoint exposed by the Helm Public API. Each request includes a description, a list of accepted filters and body fields with their types, sort options, pagination notes, and at least one example response.\n\n## Getting started\n\n1. Set the collection variable `base_url` to your tenant URL (e.g. `https://your-company.myhelm.app/public-api`).\n    \n2. Ask an Administrator to tick **Enable API Access** for your user in **Settings → User Setup** (see *API access* below). Then open the **Auth → Login** request and put your dashboard email and password into the JSON body. Run the request — on success the response token is automatically saved to the `auth_token` collection variable, and every other request is pre-configured to use it as a Bearer token.\n    \n3. From there you can run any other request directly. For requests that need a record ID (an order, an inventory item, etc.) update the corresponding placeholder collection variable (`order_id`, `inventory_id`, …) before sending.\n    \n\n## Authentication\n\nAll endpoints (other than the login endpoint itself) require a valid JWT access token, sent as a Bearer token in the `Authorization` header:\n\n```\nAuthorization: Bearer eyJhbGciOi...\n\n ```\n\nTokens are issued by `POST /auth/login` and remain valid until invalidated by the server. To check whether a token is still good, call `GET /auth/verify`.\n\n## API access\n\nAPI access is switched on per user. An Administrator enables it in **Settings → User Setup** by ticking **Enable API Access** on the user, and only Administrator, Supervisor and Warehouse Operative users can have it. Users created after this setting was introduced start with API access off; users who were already Administrators, Supervisors or Warehouse Operatives when it was introduced were given API access.\n\nA Warehouse Operative with API access can log in, but only reaches the endpoints marked **Warehouse Operative level or above** (listing, viewing and confirming assemblies). Every other endpoint needs Supervisor level and returns `401` `Unsufficient Permissions for this user` to a Warehouse Operative.\n\nWhat an API user can see and change depends on how the user is set up:\n\n- A user linked to a fulfilment client can only reach that fulfilment client's data. This is the user to give a fulfilment client for their own integration.\n- A user that is not linked to a fulfilment client can reach every record on the account, including the data of every fulfilment client. Only give API access to such a user for your own staff or systems.\n\nLogging in as a user without API access returns `401` with `API access is not enabled for this user. Ask an administrator to enable it in User Setup.` Withdrawing API access, or lowering the user below Warehouse Operative, also stops tokens that were already issued to that user: their next request returns the same `401`.\n\n## Permission levels\n\nThe API enforces user permission levels. Most endpoints require **Supervisor** level or above. A small number of administrative endpoints (user management) require **Admin** level. Some endpoints are blocked for fulfilment-client users — these are flagged in the request description with `Not available to fulfilment-client users`.\n\n## Filter syntax\n\nList endpoints accept filters via query parameters using bracket notation:\n\n```\nGET /orders?filters[status][]=2&filters[status][]=3\nGET /inventory?filters[search]=red widget&filters[search_field]=search_product_name\n\n ```\n\n- Single value: `filters[]=`\n    \n- Multiple values: `filters[][]=&filters[][]=` (combined with OR within the field)\n    \n- Multiple filters on the same request are combined with AND.\n    \n- A handful of filters use literal separators inside a single value — the most common is the inventory `multiple_sku` filter which uses `||`, e.g. `filters[multiple_sku]=SKU-A||SKU-B||SKU-C`. These are called out per-endpoint where they apply.\n    \n- Search filters use `|` (single pipe) to OR multiple terms inside one search box, e.g. `filters[search]=red|blue` matches records containing either term.\n    \n\n## Pagination\n\nEvery list endpoint is paginated. Two parameter names are used across the API depending on the endpoint:\n\n- `page` — current page number, 1-based (always supported).\n    \n- `limit` (used by Orders) **or** `per_page` (used by everything else) — items per page. The exact name is documented on each endpoint.\n    \n\nList responses are wrapped:\n\n``` json\n{\n  \"total\": 1280,\n  \"per_page\": 50,\n  \"current_page\": 1,\n  \"last_page\": 26,\n  \"next_page_url\": \"https://your-company.myhelm.app/public-api/orders?&page=2\",\n  \"prev_page_url\": null,\n  \"from\": 0,\n  \"to\": 50,\n  \"data\": [ /* records */ ]\n}\n\n ```\n\n## Sorting\n\nList endpoints accept a `sort` query parameter that takes a named sort option, not a column name. Each list endpoint has its own enum of valid sort options — see the per-endpoint description. Common pattern: `_az` / `_za` for alphabetical, `_hl` / `_lh` for high-to-low / low-to-high, `_pr` / `_rp` for past-to-recent / recent-to-past.\n\n## Date filters\n\nDate-range filters are passed as a single comma-separated string. Two formats are used in the API depending on the endpoint:\n\n- **`DD/MM/YYYY,DD/MM/YYYY`** — used by order date filters (`received_date_range`, `dispatched_date_range`, `ship_by_date_range`, `last_updated_date_range`).\n    \n- **`,`** — used by log and shipment date filters (`date_range`, `last_updated_date_range`).\n    \n\nThe per-endpoint description always states which format applies.\n\n## Standard error responses\n\n| HTTP | When | Body shape |\n| --- | --- | --- |\n| `401` | Missing / invalid / expired token, or insufficient permissions | `{\"error\": \"...\"}` |\n| `404` | Resource not found | `{\"error\": \"...\"}` |\n| `407` | Login requires 2FA code | `{\"error\": \"2FA code required\"}` |\n| `422` | Validation error | `{\"validation_error\": {\"\": \"\"}}` (object) or `{\"validation_error\": \"\"}` (string) |\n| `429` | Rate limit exceeded | `{\"error\": \"Too many requests have been sent. Please wait X seconds before trying again.\"}` |\n\n## Rate limiting\n\nEvery endpoint is rate-limited per IP address. Each response includes:\n\n- `X-RateLimit-Capacity` — total requests allowed in the current window.\n    \n- `X-RateLimit-RefillTimeLeft` — seconds remaining before the window resets.\n    \n\nWhen the limit is hit you receive HTTP `429` with the message above. Back off and retry after the indicated number of seconds.","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","isPublicCollection":false,"owner":"11966424","team":6823610,"collectionId":"473f3ed8-7306-464c-98bb-48b8b39c0469","publishedId":"2sB2x9iq9V","public":true,"publicUrl":"https://api.myhelm.app","privateUrl":"https://go.postman.co/documentation/11966424-473f3ed8-7306-464c-98bb-48b8b39c0469","customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"0056FB"},"documentationLayout":"classic-double-column","customisation":{"metaTags":[{"name":"description","value":"Warehousing Software Built For Modern Fulfilment"},{"name":"title","value":"Helm WMS"}],"appearance":{"default":"light","themes":[{"name":"dark","logo":"https://content.pstmn.io/e5bf2ba3-647d-4725-bb5f-ef0b6ff07237/VmVjdG9yLTIucG5n","colors":{"top-bar":"212121","right-sidebar":"303030","highlight":"0056FB"}},{"name":"light","logo":"https://content.pstmn.io/e5bf2ba3-647d-4725-bb5f-ef0b6ff07237/VmVjdG9yLTIucG5n","colors":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"0056FB"}}]}},"version":"8.12.10","publishDate":"2025-06-18T10:12:44.000Z","activeVersionTag":"latest","documentationTheme":"light","metaTags":{"title":"Helm WMS","description":"Warehousing Software Built For Modern Fulfilment"},"logos":{"logoLight":"https://content.pstmn.io/e5bf2ba3-647d-4725-bb5f-ef0b6ff07237/VmVjdG9yLTIucG5n","logoDark":"https://content.pstmn.io/e5bf2ba3-647d-4725-bb5f-ef0b6ff07237/VmVjdG9yLTIucG5n"}},"statusCode":200},"environments":[],"user":{"authenticated":false,"permissions":{"publish":false}},"run":{"button":{"js":"https://run.pstmn.io/button.js","css":"https://run.pstmn.io/button.css"}},"web":"https://www.getpostman.com/","team":{"logo":"https://res.cloudinary.com/postman/image/upload/t_team_logo_pubdoc/v1/team/a289c85f84369fd7e890bbd89655de9b840e455b879088f42b6bc55a5e1f9ec8","favicon":"https://myhelm.app/favicon.ico"},"isEnvFetchError":false,"languages":"[{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"HttpClient\"},{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"RestSharp\"},{\"key\":\"curl\",\"label\":\"cURL\",\"variant\":\"cURL\"},{\"key\":\"dart\",\"label\":\"Dart\",\"variant\":\"http\"},{\"key\":\"go\",\"label\":\"Go\",\"variant\":\"Native\"},{\"key\":\"http\",\"label\":\"HTTP\",\"variant\":\"HTTP\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"OkHttp\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"Unirest\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"Fetch\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"jQuery\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"XHR\"},{\"key\":\"c\",\"label\":\"C\",\"variant\":\"libcurl\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Axios\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Native\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Request\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Unirest\"},{\"key\":\"objective-c\",\"label\":\"Objective-C\",\"variant\":\"NSURLSession\"},{\"key\":\"ocaml\",\"label\":\"OCaml\",\"variant\":\"Cohttp\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"cURL\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"Guzzle\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"HTTP_Request2\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"pecl_http\"},{\"key\":\"powershell\",\"label\":\"PowerShell\",\"variant\":\"RestMethod\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"http.client\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"Requests\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"httr\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"RCurl\"},{\"key\":\"ruby\",\"label\":\"Ruby\",\"variant\":\"Net::HTTP\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"Httpie\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"wget\"},{\"key\":\"swift\",\"label\":\"Swift\",\"variant\":\"URLSession\"}]","languageSettings":[{"key":"csharp","label":"C#","variant":"HttpClient"},{"key":"csharp","label":"C#","variant":"RestSharp"},{"key":"curl","label":"cURL","variant":"cURL"},{"key":"dart","label":"Dart","variant":"http"},{"key":"go","label":"Go","variant":"Native"},{"key":"http","label":"HTTP","variant":"HTTP"},{"key":"java","label":"Java","variant":"OkHttp"},{"key":"java","label":"Java","variant":"Unirest"},{"key":"javascript","label":"JavaScript","variant":"Fetch"},{"key":"javascript","label":"JavaScript","variant":"jQuery"},{"key":"javascript","label":"JavaScript","variant":"XHR"},{"key":"c","label":"C","variant":"libcurl"},{"key":"nodejs","label":"NodeJs","variant":"Axios"},{"key":"nodejs","label":"NodeJs","variant":"Native"},{"key":"nodejs","label":"NodeJs","variant":"Request"},{"key":"nodejs","label":"NodeJs","variant":"Unirest"},{"key":"objective-c","label":"Objective-C","variant":"NSURLSession"},{"key":"ocaml","label":"OCaml","variant":"Cohttp"},{"key":"php","label":"PHP","variant":"cURL"},{"key":"php","label":"PHP","variant":"Guzzle"},{"key":"php","label":"PHP","variant":"HTTP_Request2"},{"key":"php","label":"PHP","variant":"pecl_http"},{"key":"powershell","label":"PowerShell","variant":"RestMethod"},{"key":"python","label":"Python","variant":"http.client"},{"key":"python","label":"Python","variant":"Requests"},{"key":"r","label":"R","variant":"httr"},{"key":"r","label":"R","variant":"RCurl"},{"key":"ruby","label":"Ruby","variant":"Net::HTTP"},{"key":"shell","label":"Shell","variant":"Httpie"},{"key":"shell","label":"Shell","variant":"wget"},{"key":"swift","label":"Swift","variant":"URLSession"}],"languageOptions":[{"label":"C# - HttpClient","value":"csharp - HttpClient - C#"},{"label":"C# - RestSharp","value":"csharp - RestSharp - C#"},{"label":"cURL - cURL","value":"curl - cURL - cURL"},{"label":"Dart - http","value":"dart - http - Dart"},{"label":"Go - Native","value":"go - Native - Go"},{"label":"HTTP - HTTP","value":"http - HTTP - HTTP"},{"label":"Java - OkHttp","value":"java - OkHttp - Java"},{"label":"Java - Unirest","value":"java - Unirest - Java"},{"label":"JavaScript - Fetch","value":"javascript - Fetch - JavaScript"},{"label":"JavaScript - jQuery","value":"javascript - jQuery - JavaScript"},{"label":"JavaScript - XHR","value":"javascript - XHR - JavaScript"},{"label":"C - libcurl","value":"c - libcurl - C"},{"label":"NodeJs - Axios","value":"nodejs - Axios - NodeJs"},{"label":"NodeJs - Native","value":"nodejs - Native - NodeJs"},{"label":"NodeJs - Request","value":"nodejs - Request - NodeJs"},{"label":"NodeJs - Unirest","value":"nodejs - Unirest - NodeJs"},{"label":"Objective-C - NSURLSession","value":"objective-c - NSURLSession - Objective-C"},{"label":"OCaml - Cohttp","value":"ocaml - Cohttp - OCaml"},{"label":"PHP - cURL","value":"php - cURL - PHP"},{"label":"PHP - Guzzle","value":"php - Guzzle - PHP"},{"label":"PHP - HTTP_Request2","value":"php - HTTP_Request2 - PHP"},{"label":"PHP - pecl_http","value":"php - pecl_http - PHP"},{"label":"PowerShell - RestMethod","value":"powershell - RestMethod - PowerShell"},{"label":"Python - http.client","value":"python - http.client - Python"},{"label":"Python - Requests","value":"python - Requests - Python"},{"label":"R - httr","value":"r - httr - R"},{"label":"R - RCurl","value":"r - RCurl - R"},{"label":"Ruby - Net::HTTP","value":"ruby - Net::HTTP - Ruby"},{"label":"Shell - Httpie","value":"shell - Httpie - Shell"},{"label":"Shell - wget","value":"shell - wget - Shell"},{"label":"Swift - URLSession","value":"swift - URLSession - Swift"}],"layoutOptions":[{"value":"classic-single-column","label":"Single Column"},{"value":"classic-double-column","label":"Double Column"}],"versionOptions":[],"environmentOptions":[{"value":"0","label":"No Environment"}],"canonicalUrl":"https://api.myhelm.app/view/metadata/2sB2x9iq9V"}