Integration guide

Your connection to
Nalpac products & orders.

Find products, choose a shipping option, submit an order, and retrieve its details. Start with your API credentials and the seven calls in this guide.

BASE URLhttps://api2.nalpac.com

01 / AuthenticateSend Basic credentials on every call.

02 / Build your requestUse JSON and the examples below.

03 / Check the responseInspect the status and response body.

Examples use JSON, fictional data, and environment variables for credentials. This guide documents the default API version (version 1); api2.nalpac.com is the hostname and does not select version 2. Omit the api-version header to match these examples.

Getting started

Authenticate every request

Use your Nalpac API username and password with HTTP Basic authentication. Your account must be active and have access to the API area you are calling: products, orders, or carriers.

The client joins your username and password with a colon, Base64-encodes that string, and sends it in the Authorization header. There is no separate login call or token exchange for these examples.

Authorization: Basic BASE64_OF_USERNAME_COLON_PASSWORD
Accept: application/json

Base64 is encoding, not encryption. Always use HTTPS. The current authentication parser expects ASCII credentials with no colon inside either value. Keep credentials on your server and out of browser-delivered JavaScript.

Set credentials once

Set NALPAC_USERNAME and NALPAC_PASSWORD in your execution environment. These placeholder values are not valid credentials.

export NALPAC_USERNAME='YOUR_USERNAME'
export NALPAC_PASSWORD='YOUR_PASSWORD'

In PowerShell, set variables with $env:NALPAC_USERNAME = 'YOUR_USERNAME' and $env:NALPAC_PASSWORD = 'YOUR_PASSWORD'. The cURL snippets below use Bash syntax; run them in a Bash-compatible shell.

Choose your language

C#: a console application supporting top-level statements and async, using HttpClient. PHP: CLI or server-side PHP with the cURL extension. JavaScript: Node.js with built-in fetch; save as example.mjs and run node example.mjs. All POST examples read order.json from the working directory.

Send Accept: application/json to request JSON. For POST, also send Content-Type: application/json. When substituting values, URL-encode path segments and query values with your language’s URI encoder.

Products / 01

Find a product by SKU

GETapi/product/{sku}

Look up a single item using its Nalpac SKU.

Returns one product object. The lookup includes sellable, non-deleted products at the selected location. A missing match returns 404 Not Found.

Field	Description
sku / upc	Required string. Preserve leading zeros; URL-encode the value.
stripDescriptionHTML	Optional boolean, default false. Set true to remove HTML from Description.
locationId	Optional number. Defaults to 15; 15 and 25 are supported. Other values fall back to 15.

WholesalePrice is the product wholesale price. AvailableQuantity and QuantityOnHand both contain the same calculated available quantity in this implementation. Other fields include descriptions, dimensions, manufacturer, categories, attributes, and dates; nullable values may be null.

Request examples

curl --include \
  --user "$NALPAC_USERNAME:$NALPAC_PASSWORD" \
  --header "Accept: application/json" \
  "https://api2.nalpac.com/api/product/10006"

using System;
using System.IO;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;

var username = Environment.GetEnvironmentVariable("NALPAC_USERNAME")
    ?? throw new Exception("Set NALPAC_USERNAME");
var password = Environment.GetEnvironmentVariable("NALPAC_PASSWORD")
    ?? throw new Exception("Set NALPAC_PASSWORD");
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
using var response = await client.GetAsync("https://api2.nalpac.com/api/product/10006");
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine($"HTTP {(int)response.StatusCode}\n{body}");
response.EnsureSuccessStatusCode();

<?php
$username = getenv('NALPAC_USERNAME');
$password = getenv('NALPAC_PASSWORD');
if (!$username || !$password) { throw new RuntimeException('Set API credentials'); }
$ch = curl_init('https://api2.nalpac.com/api/product/10006');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
    CURLOPT_USERPWD => $username . ':' . $password,
    CURLOPT_HTTPHEADER => ['Accept: application/json'],
    CURLOPT_TIMEOUT => 60
]);
$result = curl_exec($ch);
if ($result === false) { throw new RuntimeException(curl_error($ch)); }
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP $status\n$result\n";
if ($status >= 400) { throw new RuntimeException("API returned HTTP $status"); }

const { NALPAC_USERNAME: username, NALPAC_PASSWORD: password } = process.env;
if (!username || !password) throw new Error("Set API credentials");
const authorization = "Basic " + Buffer.from(`${username}:${password}`, "ascii").toString("base64");
const response = await fetch("https://api2.nalpac.com/api/product/10006", {
  method: "GET",
  headers: {
    Authorization: authorization,
    Accept: "application/json"
  }
});
const body = await response.text();
console.log(`HTTP ${response.status}\n${body}`);
if (!response.ok) throw new Error(`API returned HTTP ${response.status}`);

200 OK · illustrative response

Fictional values. Abbreviated response showing selected fields; additional fields are returned.

{
  "Sku": "10006",
  "Upc": "012345678905",
  "Name": "Example product",
  "WholesalePrice": 12.5,
  "LocationId": 15,
  "AvailableQuantity": 24,
  "QuantityOnHand": 24,
  "Discontinued": false,
  "Sellable": true
}

Products / 02

Find a product by UPC

GETapi/product?upc={upc}

Look up a single item using its UPC barcode. Send the UPC as text to retain leading zeros.

Returns one product object. The lookup includes sellable, non-deleted products at the selected location. A missing match returns 404 Not Found.

Field	Description
sku / upc	Required string. Preserve leading zeros; URL-encode the value.
stripDescriptionHTML	Optional boolean, default false. Set true to remove HTML from Description.
locationId	Optional number. Defaults to 15; 15 and 25 are supported. Other values fall back to 15.

Request examples

curl --include \
  --user "$NALPAC_USERNAME:$NALPAC_PASSWORD" \
  --header "Accept: application/json" \
  "https://api2.nalpac.com/api/product?upc=012345678905"

using System;
using System.IO;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;

var username = Environment.GetEnvironmentVariable("NALPAC_USERNAME")
    ?? throw new Exception("Set NALPAC_USERNAME");
var password = Environment.GetEnvironmentVariable("NALPAC_PASSWORD")
    ?? throw new Exception("Set NALPAC_PASSWORD");
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
using var response = await client.GetAsync("https://api2.nalpac.com/api/product?upc=012345678905");
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine($"HTTP {(int)response.StatusCode}\n{body}");
response.EnsureSuccessStatusCode();

<?php
$username = getenv('NALPAC_USERNAME');
$password = getenv('NALPAC_PASSWORD');
if (!$username || !$password) { throw new RuntimeException('Set API credentials'); }
$ch = curl_init('https://api2.nalpac.com/api/product?upc=012345678905');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
    CURLOPT_USERPWD => $username . ':' . $password,
    CURLOPT_HTTPHEADER => ['Accept: application/json'],
    CURLOPT_TIMEOUT => 60
]);
$result = curl_exec($ch);
if ($result === false) { throw new RuntimeException(curl_error($ch)); }
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP $status\n$result\n";
if ($status >= 400) { throw new RuntimeException("API returned HTTP $status"); }

const { NALPAC_USERNAME: username, NALPAC_PASSWORD: password } = process.env;
if (!username || !password) throw new Error("Set API credentials");
const authorization = "Basic " + Buffer.from(`${username}:${password}`, "ascii").toString("base64");
const response = await fetch("https://api2.nalpac.com/api/product?upc=012345678905", {
  method: "GET",
  headers: {
    Authorization: authorization,
    Accept: "application/json"
  }
});
const body = await response.text();
console.log(`HTTP ${response.status}\n${body}`);
if (!response.ok) throw new Error(`API returned HTTP ${response.status}`);

200 OK · illustrative response

Fictional values. Abbreviated response showing selected fields; additional fields are returned.

{
  "Sku": "10006",
  "Upc": "012345678905",
  "Name": "Example product",
  "WholesalePrice": 12.5,
  "LocationId": 15,
  "AvailableQuantity": 24,
  "QuantityOnHand": 24,
  "Discontinued": false,
  "Sellable": true
}

Orders / 03

List orders

GETapi/order

Retrieve a page of imported orders for the customer linked to your API account.

Returns an object with Orders, PageNumber, PageSize, TotalItems, and TotalPages. Pages contain up to 10 orders; this call has no configurable page size. Start at page 1 and increment pageNumber until you reach TotalPages.

Field	Description
pageNumber	Optional integer, default 1. Values below 1 are treated as 1.
orderedAfter / orderedBefore	Optional ISO date/time. Inclusive order-date bounds, for example 2026-09-01T00:00:00. A date without a time represents midnight.
shippedAfter / shippedBefore	Optional ISO date/time. Inclusive ship-date bounds using invoice records.
shipToName	Optional exact shipping-recipient name.
sortBy	Optional: OrderNumber (default), OrderNumberDesc, OrderDate, or OrderDateDesc.

Example next page: api/order?pageNumber=2. An empty result has an empty Orders array. Newly queued submissions are not included in this imported-order listing.

Request examples

curl --include \
  --user "$NALPAC_USERNAME:$NALPAC_PASSWORD" \
  --header "Accept: application/json" \
  "https://api2.nalpac.com/api/order"

using System;
using System.IO;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;

var username = Environment.GetEnvironmentVariable("NALPAC_USERNAME")
    ?? throw new Exception("Set NALPAC_USERNAME");
var password = Environment.GetEnvironmentVariable("NALPAC_PASSWORD")
    ?? throw new Exception("Set NALPAC_PASSWORD");
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
using var response = await client.GetAsync("https://api2.nalpac.com/api/order");
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine($"HTTP {(int)response.StatusCode}\n{body}");
response.EnsureSuccessStatusCode();

<?php
$username = getenv('NALPAC_USERNAME');
$password = getenv('NALPAC_PASSWORD');
if (!$username || !$password) { throw new RuntimeException('Set API credentials'); }
$ch = curl_init('https://api2.nalpac.com/api/order');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
    CURLOPT_USERPWD => $username . ':' . $password,
    CURLOPT_HTTPHEADER => ['Accept: application/json'],
    CURLOPT_TIMEOUT => 60
]);
$result = curl_exec($ch);
if ($result === false) { throw new RuntimeException(curl_error($ch)); }
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP $status\n$result\n";
if ($status >= 400) { throw new RuntimeException("API returned HTTP $status"); }

const { NALPAC_USERNAME: username, NALPAC_PASSWORD: password } = process.env;
if (!username || !password) throw new Error("Set API credentials");
const authorization = "Basic " + Buffer.from(`${username}:${password}`, "ascii").toString("base64");
const response = await fetch("https://api2.nalpac.com/api/order", {
  method: "GET",
  headers: {
    Authorization: authorization,
    Accept: "application/json"
  }
});
const body = await response.text();
console.log(`HTTP ${response.status}\n${body}`);
if (!response.ok) throw new Error(`API returned HTTP ${response.status}`);

200 OK · illustrative response

Fictional values. Abbreviated response showing selected fields; additional fields are returned.

{
  "PageNumber": 1,
  "PageSize": 10,
  "TotalItems": 1,
  "TotalPages": 1,
  "Orders": [
    {
      "OrderNumber": "1234567",
      "ExternalOrderNumber": "WEB00001",
      "PoNumber": "PO-DEMO-001",
      "OrderDate": "2026-09-15T10:00:00",
      "Carrier": "Example Ground",
      "Status": "Processing",
      "OrderLines": [
        {
          "Sku": "10006",
          "QuantityOrdered": 2,
          "UnitOfMeasure": "EA"
        }
      ],
      "Invoices": [],
      "Packages": []
    }
  ]
}

Orders / 04

Find an order by order number

GETapi/order/{orderNumber}

Retrieve details using the Nalpac order number.

Field	Description
orderNumber	Required string in the URL path. Use the Nalpac order number for an imported order. The pending-order fallback searches by ExternalOrderNumber.

Returns one order object, including OrderLines, Invoices, and Packages. A missing match returns 404 Not Found. Typical status values are Processing, Packing, and Shipped.

A pending match can instead return a sparse object with status In queue waiting to be processed. Handle missing or null details and empty arrays until processing completes.

Request examples

curl --include \
  --user "$NALPAC_USERNAME:$NALPAC_PASSWORD" \
  --header "Accept: application/json" \
  "https://api2.nalpac.com/api/order/1234567"

using System;
using System.IO;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;

var username = Environment.GetEnvironmentVariable("NALPAC_USERNAME")
    ?? throw new Exception("Set NALPAC_USERNAME");
var password = Environment.GetEnvironmentVariable("NALPAC_PASSWORD")
    ?? throw new Exception("Set NALPAC_PASSWORD");
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
using var response = await client.GetAsync("https://api2.nalpac.com/api/order/1234567");
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine($"HTTP {(int)response.StatusCode}\n{body}");
response.EnsureSuccessStatusCode();

<?php
$username = getenv('NALPAC_USERNAME');
$password = getenv('NALPAC_PASSWORD');
if (!$username || !$password) { throw new RuntimeException('Set API credentials'); }
$ch = curl_init('https://api2.nalpac.com/api/order/1234567');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
    CURLOPT_USERPWD => $username . ':' . $password,
    CURLOPT_HTTPHEADER => ['Accept: application/json'],
    CURLOPT_TIMEOUT => 60
]);
$result = curl_exec($ch);
if ($result === false) { throw new RuntimeException(curl_error($ch)); }
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP $status\n$result\n";
if ($status >= 400) { throw new RuntimeException("API returned HTTP $status"); }

const { NALPAC_USERNAME: username, NALPAC_PASSWORD: password } = process.env;
if (!username || !password) throw new Error("Set API credentials");
const authorization = "Basic " + Buffer.from(`${username}:${password}`, "ascii").toString("base64");
const response = await fetch("https://api2.nalpac.com/api/order/1234567", {
  method: "GET",
  headers: {
    Authorization: authorization,
    Accept: "application/json"
  }
});
const body = await response.text();
console.log(`HTTP ${response.status}\n${body}`);
if (!response.ok) throw new Error(`API returned HTTP ${response.status}`);

200 OK · illustrative response

Fictional values. Abbreviated response showing selected fields; additional fields are returned.

{
  "OrderNumber": "1234567",
  "ExternalOrderNumber": "WEB00001",
  "PoNumber": "PO-DEMO-001",
  "OrderDate": "2026-09-15T10:00:00",
  "Carrier": "Example Ground",
  "Status": "Processing",
  "OrderLines": [
    {
      "Sku": "10006",
      "QuantityOrdered": 2,
      "UnitOfMeasure": "EA"
    }
  ],
  "Invoices": [],
  "Packages": []
}

Orders / 05

Find an order by PO number

GETapi/order?poNumber={poNumber}

Find an order using the purchase order reference you supplied when submitting it.

Field	Description
poNumber	Required query string. Uses an exact PO-number match; URL-encode spaces and special characters.

This default-version call returns one order, not a paginated collection. If a PO is reused, it returns the first match; use distinct PO numbers when you need unambiguous lookups.

Returns one order object, including OrderLines, Invoices, and Packages. A missing match returns 404 Not Found. Typical status values are Processing, Packing, and Shipped.

A pending match can instead return a sparse object with status In queue waiting to be processed. Handle missing or null details and empty arrays until processing completes.

Request examples

curl --include \
  --user "$NALPAC_USERNAME:$NALPAC_PASSWORD" \
  --header "Accept: application/json" \
  "https://api2.nalpac.com/api/order?poNumber=PO-DEMO-001"

using System;
using System.IO;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;

var username = Environment.GetEnvironmentVariable("NALPAC_USERNAME")
    ?? throw new Exception("Set NALPAC_USERNAME");
var password = Environment.GetEnvironmentVariable("NALPAC_PASSWORD")
    ?? throw new Exception("Set NALPAC_PASSWORD");
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
using var response = await client.GetAsync("https://api2.nalpac.com/api/order?poNumber=PO-DEMO-001");
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine($"HTTP {(int)response.StatusCode}\n{body}");
response.EnsureSuccessStatusCode();

<?php
$username = getenv('NALPAC_USERNAME');
$password = getenv('NALPAC_PASSWORD');
if (!$username || !$password) { throw new RuntimeException('Set API credentials'); }
$ch = curl_init('https://api2.nalpac.com/api/order?poNumber=PO-DEMO-001');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
    CURLOPT_USERPWD => $username . ':' . $password,
    CURLOPT_HTTPHEADER => ['Accept: application/json'],
    CURLOPT_TIMEOUT => 60
]);
$result = curl_exec($ch);
if ($result === false) { throw new RuntimeException(curl_error($ch)); }
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP $status\n$result\n";
if ($status >= 400) { throw new RuntimeException("API returned HTTP $status"); }

const { NALPAC_USERNAME: username, NALPAC_PASSWORD: password } = process.env;
if (!username || !password) throw new Error("Set API credentials");
const authorization = "Basic " + Buffer.from(`${username}:${password}`, "ascii").toString("base64");
const response = await fetch("https://api2.nalpac.com/api/order?poNumber=PO-DEMO-001", {
  method: "GET",
  headers: {
    Authorization: authorization,
    Accept: "application/json"
  }
});
const body = await response.text();
console.log(`HTTP ${response.status}\n${body}`);
if (!response.ok) throw new Error(`API returned HTTP ${response.status}`);

200 OK · illustrative response

Fictional values. Abbreviated response showing selected fields; additional fields are returned.

{
  "OrderNumber": "1234567",
  "ExternalOrderNumber": "WEB00001",
  "PoNumber": "PO-DEMO-001",
  "OrderDate": "2026-09-15T10:00:00",
  "Carrier": "Example Ground",
  "Status": "Processing",
  "OrderLines": [
    {
      "Sku": "10006",
      "QuantityOrdered": 2,
      "UnitOfMeasure": "EA"
    }
  ],
  "Invoices": [],
  "Packages": []
}

Orders / 06

Create an order

POSTapi/order

Submit an order with a shipping address, shipping option, and line items.

Look up the products you want to order.
Use List carriers to choose a shipping option.
Prepare order.json using the body below and submit it once.
Save the response, then use the PO lookup to follow processing.

Replace the example SKU, address, references, and ShippingOptionId 12345 before submitting. The shipping option is illustrative and may not exist. A successful POST creates a real order request.

Field	Description
ExternalOrderNumber	Send a unique reference of up to 8 characters to preserve it unchanged. Longer values are transformed into an 8-character hash. If blank, the server generates a reference.
PoNumber	Optional purchase order reference, maximum 50 characters. Supplying a unique value makes subsequent lookup easier.
OrderDate	Send an ISO date/time. Defaults to server time if omitted.
ShippingAddress	Required object. Supply Name, Address1, City, State, ZipCode and Country; Address2 and Address3 are available for extra address lines.
ShippingOptionId	Required integer from Carriers[].ShippingOptions[].Id. Do not use the carrier GUID.
CreateOrderRequestLines	Required array. Send at least one line with Sku (maximum 40 characters) and Quantity (integer from 1 to 999999999).
UnitOfMeasure	Optional line field, maximum 8 characters. Use the appropriate unit for the item; EA is illustrative.
ShipLocationId	Optional line field, string "15" or "25". If omitted, the server fills it from the account shipping setup. Other supplied values fall back to "15"; routing rules may adjust locations.
OrderNotes	Optional order notes.
ShipToPhoneNumber / ShipToEmailAddress	Optional recipient contact details.
DeliveryInstructions	Optional string, maximum 255 characters.
SignatureRequired	Optional boolean, default false.
PackingSlipType	Optional account-specific packing slip selection; confirm the appropriate value for your account.
SalesLocationId / Carrier / OrderNumber	Do not rely on these to select shipping or assign an order number. SalesLocationId is set by the server; select shipping with ShippingOptionId.

Request body

Save as order.json in your working directory. All four POST examples read this same file. Download the example JSON.

{
  "ExternalOrderNumber": "WEB00001",
  "PoNumber": "PO-DEMO-001",
  "OrderDate": "2026-09-15T10:00:00",
  "ShippingAddress": {
    "Name": "Example Receiving",
    "Address1": "123 Example Street",
    "Address2": "Suite 100",
    "City": "Ferndale",
    "State": "MI",
    "ZipCode": "48220",
    "Country": "US"
  },
  "ShippingOptionId": 12345,
  "ShipToPhoneNumber": "248-555-0100",
  "ShipToEmailAddress": "receiving@example.com",
  "DeliveryInstructions": "Deliver to receiving desk.",
  "SignatureRequired": false,
  "CreateOrderRequestLines": [
    {
      "Sku": "10006",
      "Quantity": 2,
      "UnitOfMeasure": "EA"
    }
  ]
}

After submission

The handler returns 201 Created, a Location header, and the submitted request object, potentially modified by account rules. It does not return a finalized Nalpac order number as a standalone result. A 201 response alone does not establish that processing or shipment has completed; check the order using its PO reference.

Invalid SKUs, shipping options, or model fields can return 400 Bad Request. A detected duplicate returns {"Message":"Duplicate Order!"}. If a request times out or fails ambiguously, check by PO before resubmitting; duplicate detection is not a guarantee that every repeated request is prevented.

Request examples

curl --include \
  --user "$NALPAC_USERNAME:$NALPAC_PASSWORD" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data-binary @order.json \
  "https://api2.nalpac.com/api/order"

using System;
using System.IO;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;

var username = Environment.GetEnvironmentVariable("NALPAC_USERNAME")
    ?? throw new Exception("Set NALPAC_USERNAME");
var password = Environment.GetEnvironmentVariable("NALPAC_PASSWORD")
    ?? throw new Exception("Set NALPAC_PASSWORD");
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
using var content = new StringContent(await File.ReadAllTextAsync("order.json"), Encoding.UTF8, "application/json");
using var response = await client.PostAsync("https://api2.nalpac.com/api/order", content);
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine($"HTTP {(int)response.StatusCode}\n{body}");
response.EnsureSuccessStatusCode();

<?php
$username = getenv('NALPAC_USERNAME');
$password = getenv('NALPAC_PASSWORD');
if (!$username || !$password) { throw new RuntimeException('Set API credentials'); }
$body = file_get_contents('order.json');
if ($body === false) { throw new RuntimeException('Cannot read order.json'); }
$ch = curl_init('https://api2.nalpac.com/api/order');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
    CURLOPT_USERPWD => $username . ':' . $password,
    CURLOPT_HTTPHEADER => ['Accept: application/json', 'Content-Type: application/json'],
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $body,
    CURLOPT_TIMEOUT => 60
]);
$result = curl_exec($ch);
if ($result === false) { throw new RuntimeException(curl_error($ch)); }
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP $status\n$result\n";
if ($status >= 400) { throw new RuntimeException("API returned HTTP $status"); }

import { readFile } from "node:fs/promises";

const { NALPAC_USERNAME: username, NALPAC_PASSWORD: password } = process.env;
if (!username || !password) throw new Error("Set API credentials");
const authorization = "Basic " + Buffer.from(`${username}:${password}`, "ascii").toString("base64");
const response = await fetch("https://api2.nalpac.com/api/order", {
  method: "POST",
  headers: {
    Authorization: authorization,
    Accept: "application/json",
    "Content-Type": "application/json"
  },
  body: await readFile("order.json", "utf8")
});
const body = await response.text();
console.log(`HTTP ${response.status}\n${body}`);
if (!response.ok) throw new Error(`API returned HTTP ${response.status}`);

201 Created · illustrative response

Fictional values. Abbreviated response showing selected fields; additional fields are returned.

{
  "ExternalOrderNumber": "WEB00001",
  "PoNumber": "PO-DEMO-001",
  "ShippingOptionId": 12345,
  "SalesLocationId": "15",
  "CreateOrderRequestLines": [
    {
      "Sku": "10006",
      "Quantity": 2,
      "UnitOfMeasure": "EA",
      "ShipLocationId": "15"
    }
  ]
}

Shipping / 07

List carriers

GETapi/carrier

Retrieve available carriers and the shipping options you can use when creating an order.

The response wraps the list in Carriers. Each carrier has a GUID Id, a Name, and a ShippingOptions array.

For POST api/order, copy the integer ShippingOptions[].Id into ShippingOptionId. The carrier’s own GUID is a different identifier.

This basic listing does not calculate shipping quotes. Rate and TransitTimeInDays may be null.

Request examples

curl --include \
  --user "$NALPAC_USERNAME:$NALPAC_PASSWORD" \
  --header "Accept: application/json" \
  "https://api2.nalpac.com/api/carrier"

using System;
using System.IO;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;

var username = Environment.GetEnvironmentVariable("NALPAC_USERNAME")
    ?? throw new Exception("Set NALPAC_USERNAME");
var password = Environment.GetEnvironmentVariable("NALPAC_PASSWORD")
    ?? throw new Exception("Set NALPAC_PASSWORD");
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
using var response = await client.GetAsync("https://api2.nalpac.com/api/carrier");
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine($"HTTP {(int)response.StatusCode}\n{body}");
response.EnsureSuccessStatusCode();

<?php
$username = getenv('NALPAC_USERNAME');
$password = getenv('NALPAC_PASSWORD');
if (!$username || !$password) { throw new RuntimeException('Set API credentials'); }
$ch = curl_init('https://api2.nalpac.com/api/carrier');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
    CURLOPT_USERPWD => $username . ':' . $password,
    CURLOPT_HTTPHEADER => ['Accept: application/json'],
    CURLOPT_TIMEOUT => 60
]);
$result = curl_exec($ch);
if ($result === false) { throw new RuntimeException(curl_error($ch)); }
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP $status\n$result\n";
if ($status >= 400) { throw new RuntimeException("API returned HTTP $status"); }

const { NALPAC_USERNAME: username, NALPAC_PASSWORD: password } = process.env;
if (!username || !password) throw new Error("Set API credentials");
const authorization = "Basic " + Buffer.from(`${username}:${password}`, "ascii").toString("base64");
const response = await fetch("https://api2.nalpac.com/api/carrier", {
  method: "GET",
  headers: {
    Authorization: authorization,
    Accept: "application/json"
  }
});
const body = await response.text();
console.log(`HTTP ${response.status}\n${body}`);
if (!response.ok) throw new Error(`API returned HTTP ${response.status}`);

200 OK · illustrative response

Fictional values. Use the real IDs returned for your account.

{
  "Carriers": [
    {
      "Id": "00000000-0000-0000-0000-000000000001",
      "Name": "Example Carrier",
      "ShippingOptions": [
        {
          "Id": 12345,
          "Description": "Example Ground",
          "Rate": null,
          "TransitTimeInDays": null
        }
      ]
    }
  ]
}

Reference

Handle the response

Status	Next step
200 OK	GET succeeded. Read the returned object or collection wrapper.
201 Created	An order request response was created. Check subsequent processing using the PO lookup.
400 Bad Request	Inspect the error body for validation details or duplicate-order detection.
401 Unauthorized	Check username, password, account status, and endpoint permissions. Basic authentication failures include WWW-Authenticate: Basic.
404 Not Found	No matching product or order was found, or the requested route does not match.
5xx / network failure	The request failed or its outcome is uncertain. For POST, check by PO before deciding whether to resubmit.

Response examples in this guide are illustrative, not captured live responses. Check the HTTP status before parsing an expected data object; error bodies and empty responses need separate handling. Avoid automatically retrying order creation after an uncertain outcome.

Your connection toNalpac products & orders.

Authenticate every request

Set credentials once

Choose your language

Find a product by SKU

Request examples

Find a product by UPC

Request examples

List orders

Request examples

Find an order by order number

Request examples

Find an order by PO number

Request examples

Create an order

Request body

After submission

Request examples

List carriers

Request examples

Handle the response

Your connection to
Nalpac products & orders.