Details not included in the payload keep their current values. The request is all or nothing: if one row is refused, no row is saved.

This endpoint accepts OAuth access tokens only, as described in Authentication. A v1 API token (Authorization: Token ...) is refused with 401.

Order approval settings

order_approval_enabled, daily_order_threshold and approver_roles are returned to every library with their stored values, whether or not it has the Order Approval module.

• Without the module, a request that changes any of them is refused with 400, naming only the fields whose value differs from the stored one. Sending the stored values back is accepted, so a record that is read and written back whole goes through.
• approver_roles is written as role IDs. It is read as role objects (id, name) and written as a list of their IDs, like a user connector's role. Sending the objects back is refused with 400.
• Enabling needs a threshold. order_approval_enabled: true without a non-null daily_order_threshold in the same row is refused with 400 on daily_order_threshold, even when a threshold is already stored.
• Roles are checked when written. Each one must belong to the library, be a library or outlet role and hold the Approve Orders permission; otherwise the request is refused with 400 on approver_roles, listing the rejected IDs.

Within a row, order_approval_enabled and daily_order_threshold travel together:

• Sending one without the other is refused with 400, naming the missing one.
• order_approval_enabled: false with a threshold turns approval off and stores that threshold; with null, it also clears the threshold.
• A row with neither leaves both as they are. approver_roles can be sent with or without them.