Inventory REST API

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

// ---- EDIT THESE -----------------------------------------------------------
const string BaseUrl = "https://play.example.com";   // your P21 server
const string Username = "apiuser";
const string Password = "your-password";
const string ItemId = "WIDGET-001";                     // item to look up
// ---------------------------------------------------------------------------

var handler = new HttpClientHandler
{
    // Test tenants often present a self-signed cert. Delete this line in production.
    ServerCertificateCustomValidationCallback =
        HttpClientHandler.DangerousAcceptAnyServerCertificateValidator,
};
using var client = new HttpClient(handler) { Timeout = TimeSpan.FromMinutes(2) };
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

var token = await GetTokenAsync(client);
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

var resp = await client.GetAsync($"{BaseUrl}/api/inventory/parts/{ItemId}");
resp.EnsureSuccessStatusCode();
var item = JsonDocument.Parse(await resp.Content.ReadAsStringAsync()).RootElement;
Console.WriteLine($"{item.GetProperty("ItemId")}: {item.GetProperty("ItemDesc")}");

// --- helpers ---------------------------------------------------------------

// v2 token endpoint — credentials go in the body, never in headers.
static async Task<string> GetTokenAsync(HttpClient client)
{
    var payload = JsonSerializer.Serialize(new { username = Username, password = Password });
    var response = await client.PostAsync(
        $"{BaseUrl}/api/security/token/v2",
        new StringContent(payload, Encoding.UTF8, "application/json"));
    response.EnsureSuccessStatusCode();
    return ReadField(await response.Content.ReadAsStringAsync(), "AccessToken");
}

// Some middleware answers this endpoint in XML even when asked for JSON.
static string ReadField(string payload, string field)
{
    try
    {
        var value = JsonDocument.Parse(payload).RootElement.GetProperty(field).GetString();
        if (!string.IsNullOrEmpty(value)) return value;
    }
    catch (Exception ex) when (ex is JsonException or KeyNotFoundException) { }

    var match = System.Text.RegularExpressions.Regex.Match(payload, $"<{field}>([^<]+)</{field}>");
    if (!match.Success)
        throw new InvalidOperationException(
            $"No {field} in response: {payload[..Math.Min(200, payload.Length)]}");
    return match.Groups[1].Value;
}

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;

// ---- EDIT THESE -----------------------------------------------------------
const string BaseUrl = "https://play.example.com";   // your P21 server
const string Username = "apiuser";
const string Password = "your-password";
const string ItemId = "WIDGET-001";                     // item to look up
// ---------------------------------------------------------------------------

var handler = new HttpClientHandler
{
    // Test tenants often present a self-signed cert. Delete this line in production.
    ServerCertificateCustomValidationCallback =
        HttpClientHandler.DangerousAcceptAnyServerCertificateValidator,
};
using var client = new HttpClient(handler) { Timeout = TimeSpan.FromMinutes(2) };
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

var token = await GetTokenAsync(client);
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

var resp = await client.GetAsync($"{BaseUrl}/api/inventory/parts/{ItemId}?extendedproperties=*");
resp.EnsureSuccessStatusCode();
var item = JsonNode.Parse(await resp.Content.ReadAsStringAsync())!;

// Access nested Locations (inv_loc data)
var locations = item["Locations"]?["list"]?.AsArray();
if (locations != null)
{
    foreach (var loc in locations)
    {
        Console.WriteLine($"Loc: {loc!["LocationId"]}, Qty: {loc["QtyOnHand"]}");
    }
}

// --- helpers ---------------------------------------------------------------

// v2 token endpoint — credentials go in the body, never in headers.
static async Task<string> GetTokenAsync(HttpClient client)
{
    var payload = JsonSerializer.Serialize(new { username = Username, password = Password });
    var response = await client.PostAsync(
        $"{BaseUrl}/api/security/token/v2",
        new StringContent(payload, Encoding.UTF8, "application/json"));
    response.EnsureSuccessStatusCode();
    return ReadField(await response.Content.ReadAsStringAsync(), "AccessToken");
}

// Some middleware answers this endpoint in XML even when asked for JSON.
static string ReadField(string payload, string field)
{
    try
    {
        var value = JsonDocument.Parse(payload).RootElement.GetProperty(field).GetString();
        if (!string.IsNullOrEmpty(value)) return value;
    }
    catch (Exception ex) when (ex is JsonException or KeyNotFoundException) { }

    var match = System.Text.RegularExpressions.Regex.Match(payload, $"<{field}>([^<]+)</{field}>");
    if (!match.Success)
        throw new InvalidOperationException(
            $"No {field} in response: {payload[..Math.Min(200, payload.Length)]}");
    return match.Groups[1].Value;
}

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;

// ---- EDIT THESE -----------------------------------------------------------
const string BaseUrl = "https://play.example.com";   // your P21 server
const string Username = "apiuser";
const string Password = "your-password";
const string ItemId = "WIDGET-001";                     // item to update
const int TargetLocationId = 1;                         // inv_loc.LocationId to modify
const string TargetCompanyId = "ACME";                  // inv_loc.CompanyId to modify
const string ExtendedProps = "Locations,Suppliers,LocationSuppliers,UnitsOfMeasure";
// ---------------------------------------------------------------------------

var handler = new HttpClientHandler
{
    // Test tenants often present a self-signed cert. Delete this line in production.
    ServerCertificateCustomValidationCallback =
        HttpClientHandler.DangerousAcceptAnyServerCertificateValidator,
};
using var client = new HttpClient(handler) { Timeout = TimeSpan.FromMinutes(2) };
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

var token = await GetTokenAsync(client);
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

// 1. GET current item with Locations
var getUrl = $"{BaseUrl}/api/inventory/parts/{ItemId}?extendedproperties={ExtendedProps}";
var getResp = await client.GetAsync(getUrl);
getResp.EnsureSuccessStatusCode();
var item = JsonNode.Parse(await getResp.Content.ReadAsStringAsync())!;

// 2. Modify fields on the existing location -- do not drop the other records
var locations = item["Locations"]!["list"]!.AsArray();
var target = locations.FirstOrDefault(
    l => (int)l!["LocationId"]! == TargetLocationId && (string)l["CompanyId"]! == TargetCompanyId);
if (target != null)
{
    target["Sellable"] = "N";
    target["ProductGroupId"] = "MISC";
    target["PurchaseDiscountGroup"] = "BULK";
    target["SalesDiscountGroup"] = "RETAIL";
}

// 3. PUT the whole item back
var putContent = new StringContent(item.ToJsonString(), Encoding.UTF8, "application/json");
var putResp = await client.PutAsync($"{BaseUrl}/api/inventory/parts/{ItemId}", putContent);
putResp.EnsureSuccessStatusCode();
Console.WriteLine($"PUT status: {(int)putResp.StatusCode}");

// 4. Re-GET to prove what actually landed -- HTTP 200 alone does not confirm a write
var afterResp = await client.GetAsync(getUrl);
afterResp.EnsureSuccessStatusCode();
var after = JsonNode.Parse(await afterResp.Content.ReadAsStringAsync())!;
var afterTarget = after["Locations"]!["list"]!.AsArray().FirstOrDefault(
    l => (int)l!["LocationId"]! == TargetLocationId && (string)l["CompanyId"]! == TargetCompanyId);
if (afterTarget != null)
{
    Console.WriteLine(
        $"Sellable={afterTarget["Sellable"]} ProductGroupId={afterTarget["ProductGroupId"]} " +
        $"PurchaseDiscountGroup={afterTarget["PurchaseDiscountGroup"]} " +
        $"SalesDiscountGroup={afterTarget["SalesDiscountGroup"]}");
}

// --- helpers ---------------------------------------------------------------

// v2 token endpoint — credentials go in the body, never in headers.
static async Task<string> GetTokenAsync(HttpClient client)
{
    var payload = JsonSerializer.Serialize(new { username = Username, password = Password });
    var response = await client.PostAsync(
        $"{BaseUrl}/api/security/token/v2",
        new StringContent(payload, Encoding.UTF8, "application/json"));
    response.EnsureSuccessStatusCode();
    return ReadField(await response.Content.ReadAsStringAsync(), "AccessToken");
}

// Some middleware answers this endpoint in XML even when asked for JSON.
static string ReadField(string payload, string field)
{
    try
    {
        var value = JsonDocument.Parse(payload).RootElement.GetProperty(field).GetString();
        if (!string.IsNullOrEmpty(value)) return value;
    }
    catch (Exception ex) when (ex is JsonException or KeyNotFoundException) { }

    var match = System.Text.RegularExpressions.Regex.Match(payload, $"<{field}>([^<]+)</{field}>");
    if (!match.Success)
        throw new InvalidOperationException(
            $"No {field} in response: {payload[..Math.Min(200, payload.Length)]}");
    return match.Groups[1].Value;
}

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;

// ---- EDIT THESE -----------------------------------------------------------
const string BaseUrl = "https://play.example.com";   // your P21 server
const string Username = "apiuser";
const string Password = "your-password";
const string NewItemId = "WIDGET-002";                  // must not already exist in inv_mast
// ---------------------------------------------------------------------------

var handler = new HttpClientHandler
{
    // Test tenants often present a self-signed cert. Delete this line in production.
    ServerCertificateCustomValidationCallback =
        HttpClientHandler.DangerousAcceptAnyServerCertificateValidator,
};
using var client = new HttpClient(handler) { Timeout = TimeSpan.FromMinutes(2) };
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

var token = await GetTokenAsync(client);
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

var payload = new JsonObject
{
    ["ItemId"] = NewItemId,
    ["ItemDesc"] = "Small Widget Assembly",
    ["ObjectName"] = "inv_mast",
    ["Locations"] = new JsonObject
    {
        ["list"] = new JsonArray
        {
            new JsonObject
            {
                ["LocationId"] = 1,
                ["ProductGroupId"] = "MISC",
                ["ObjectName"] = "inv_loc",
            }
        }
    },
    ["Suppliers"] = new JsonObject
    {
        ["list"] = new JsonArray
        {
            new JsonObject
            {
                ["SupplierId"] = 10,
                ["DivisionId"] = 1,
                ["ObjectName"] = "inventory_supplier",
            }
        }
    },
    ["LocationSuppliers"] = new JsonObject
    {
        ["list"] = new JsonArray
        {
            new JsonObject
            {
                ["LocationId"] = 1,
                ["SupplierId"] = 10,
                ["PrimarySupplier"] = "Y",
                ["ObjectName"] = "inventory_supplier_x_loc",
            }
        }
    }
};

// POST returns 307 without a trailing slash -- see "POST Returns 307 Redirect" below
var content = new StringContent(payload.ToJsonString(), Encoding.UTF8, "application/json");
var resp = await client.PostAsync($"{BaseUrl}/api/inventory/parts/", content);
resp.EnsureSuccessStatusCode();
var created = JsonNode.Parse(await resp.Content.ReadAsStringAsync())!;
Console.WriteLine($"Created: {created["ItemId"]}");

// Re-GET to confirm what actually landed -- HTTP 200 alone does not confirm a write
var confirmResp = await client.GetAsync($"{BaseUrl}/api/inventory/parts/{NewItemId}");
confirmResp.EnsureSuccessStatusCode();
var confirmed = JsonNode.Parse(await confirmResp.Content.ReadAsStringAsync())!;
Console.WriteLine($"Confirmed: {confirmed["ItemId"]}: {confirmed["ItemDesc"]}");

// --- helpers ---------------------------------------------------------------

// v2 token endpoint — credentials go in the body, never in headers.
static async Task<string> GetTokenAsync(HttpClient client)
{
    var payload = JsonSerializer.Serialize(new { username = Username, password = Password });
    var response = await client.PostAsync(
        $"{BaseUrl}/api/security/token/v2",
        new StringContent(payload, Encoding.UTF8, "application/json"));
    response.EnsureSuccessStatusCode();
    return ReadField(await response.Content.ReadAsStringAsync(), "AccessToken");
}

// Some middleware answers this endpoint in XML even when asked for JSON.
static string ReadField(string payload, string field)
{
    try
    {
        var value = JsonDocument.Parse(payload).RootElement.GetProperty(field).GetString();
        if (!string.IsNullOrEmpty(value)) return value;
    }
    catch (Exception ex) when (ex is JsonException or KeyNotFoundException) { }

    var match = System.Text.RegularExpressions.Regex.Match(payload, $"<{field}>([^<]+)</{field}>");
    if (!match.Success)
        throw new InvalidOperationException(
            $"No {field} in response: {payload[..Math.Min(200, payload.Length)]}");
    return match.Groups[1].Value;
}

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;

// ---- EDIT THESE -----------------------------------------------------------
const string BaseUrl = "https://play.example.com";   // your P21 server
const string Username = "apiuser";
const string Password = "your-password";
const string SourceItemId = "WIDGET-001";               // item to copy
const string NewItemId = "WIDGET-003";                  // must not already exist in inv_mast
const string NewItemDesc = "Widget Assembly, Large";    // 40 characters or fewer
const string NewSupplierPartNo = "WIDGET-003";          // written to every supplier row
var execute = false;                                    // false prints the payload; true POSTs it
const string ExtendedProps = "Locations,Suppliers,LocationSuppliers,UnitsOfMeasure";
// ---------------------------------------------------------------------------

// Fields that identify the source record or describe its stock, per child list.
var drop = new Dictionary<string, string[]>
{
    ["Locations"] = new[] { "QtyOnHand", "MovingAverageCost", "PrimaryBin", "PeriodFirstStocked",
                            "YearFirstStocked", "PatternLikeInvMastUid", "PatternLikeLocationId",
                            "UserDefinedFields" },
    ["Suppliers"] = new[] { "InventorySupplierUid", "UserDefinedFields" },
    ["LocationSuppliers"] = new[] { "InventorySupplierXLocUid", "UserDefinedFields" },
    ["UnitsOfMeasure"] = new[] { "ItemUomUid", "UserDefinedFields" },
};

if (NewItemDesc.Length > 40) throw new InvalidOperationException("ItemDesc is over 40 characters");

var handler = new HttpClientHandler
{
    // Test tenants often present a self-signed cert. Delete this line in production.
    ServerCertificateCustomValidationCallback =
        HttpClientHandler.DangerousAcceptAnyServerCertificateValidator,
};
using var client = new HttpClient(handler) { Timeout = TimeSpan.FromMinutes(3) };
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

var token = await GetTokenAsync(client);
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

// 1. GET the source item with its child records
var getResp = await client.GetAsync(
    $"{BaseUrl}/api/inventory/parts/{SourceItemId}?extendedproperties={ExtendedProps}");
getResp.EnsureSuccessStatusCode();
var source = JsonNode.Parse(await getResp.Content.ReadAsStringAsync())!.AsObject();

// Top level: drop the source record's uid and UD block, and any null header fields, then re-key.
var payload = new JsonObject();
foreach (var (key, value) in source)
{
    if (key is "InvMastUid" or "UserDefinedFields" || drop.ContainsKey(key)) continue;
    if (value is null && char.IsUpper(key[0])) continue;
    payload[key] = value?.DeepClone();
}
payload["ItemId"] = NewItemId;
payload["ItemDesc"] = NewItemDesc;

foreach (var (key, fields) in drop)
{
    var rows = new JsonArray();
    if (source[key]?["list"] is JsonArray list)
    {
        foreach (var src in list)
        {
            var row = src!.DeepClone().AsObject();
            foreach (var f in fields) row.Remove(f);
            row["ItemId"] = NewItemId;
            if (key == "Suppliers") row["SupplierPartNo"] = NewSupplierPartNo;
            rows.Add(row);
        }
    }
    payload[key] = new JsonObject { ["list"] = rows };
}

if (!execute)
{
    Console.WriteLine(payload.ToJsonString(new JsonSerializerOptions { WriteIndented = true }));
    Console.WriteLine("DRY RUN -- nothing written. Review the payload, then set execute = true.");
    return;
}

// 2. POST the clone -- trailing slash, or the POST 307s
var content = new StringContent(payload.ToJsonString(), Encoding.UTF8, "application/json");
var postResp = await client.PostAsync($"{BaseUrl}/api/inventory/parts/", content);
if (!postResp.IsSuccessStatusCode)
{
    var body = await postResp.Content.ReadAsStringAsync();
    throw new InvalidOperationException(
        $"POST {(int)postResp.StatusCode}: {body[..Math.Min(500, body.Length)]}");
}

// 3. Re-GET to prove what actually landed -- HTTP 200 alone does not confirm a write
var afterResp = await client.GetAsync(
    $"{BaseUrl}/api/inventory/parts/{NewItemId}?extendedproperties={ExtendedProps}");
afterResp.EnsureSuccessStatusCode();
var created = JsonNode.Parse(await afterResp.Content.ReadAsStringAsync())!;
Console.WriteLine($"Created {created["ItemId"]}: {created["ItemDesc"]}");
foreach (var loc in created["Locations"]!["list"]!.AsArray())
    Console.WriteLine($"  location {loc!["LocationId"]}: ProductGroupId={loc["ProductGroupId"]} " +
                      $"Stockable={loc["Stockable"]} Sellable={loc["Sellable"]}");
foreach (var sup in created["Suppliers"]!["list"]!.AsArray())
    Console.WriteLine($"  supplier {sup!["SupplierId"]}: Cost={sup["Cost"]} " +
                      $"ListPrice={sup["ListPrice"]} SupplierPartNo={sup["SupplierPartNo"]}");

// --- helpers ---------------------------------------------------------------

// v2 token endpoint — credentials go in the body, never in headers.
static async Task<string> GetTokenAsync(HttpClient client)
{
    var payload = JsonSerializer.Serialize(new { username = Username, password = Password });
    var response = await client.PostAsync(
        $"{BaseUrl}/api/security/token/v2",
        new StringContent(payload, Encoding.UTF8, "application/json"));
    response.EnsureSuccessStatusCode();
    return ReadField(await response.Content.ReadAsStringAsync(), "AccessToken");
}

// Some middleware answers this endpoint in XML even when asked for JSON.
static string ReadField(string payload, string field)
{
    try
    {
        var value = JsonDocument.Parse(payload).RootElement.GetProperty(field).GetString();
        if (!string.IsNullOrEmpty(value)) return value;
    }
    catch (Exception ex) when (ex is JsonException or KeyNotFoundException) { }

    var match = System.Text.RegularExpressions.Regex.Match(payload, $"<{field}>([^<]+)</{field}>");
    if (!match.Success)
        throw new InvalidOperationException(
            $"No {field} in response: {payload[..Math.Min(200, payload.Length)]}");
    return match.Groups[1].Value;
}

const int MaxItemDescLength = 40;

static string ValidateItemDesc(string desc)
{
    if (desc.Length > MaxItemDescLength)
    {
        throw new ArgumentException(
            $"ItemDesc '{desc}' is {desc.Length} chars (max {MaxItemDescLength}). " +
            "POST will fail with misleading error; PUT will silently discard.");
    }
    return desc;
}

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;

// ---- EDIT THESE -----------------------------------------------------------
const string BaseUrl = "https://play.example.com";   // your P21 server
const string Username = "apiuser";
const string Password = "your-password";
const string ItemId = "WIDGET-001";                     // item to probe -- ItemDesc is overwritten, then restored
const string ExtendedProps = "Locations,Suppliers,LocationSuppliers";
string[] CandidateSymbols = { "\"", "'", "&", "<", ">", "#", "/", "\\", "%", "@" };
// ---------------------------------------------------------------------------

var handler = new HttpClientHandler
{
    // Test tenants often present a self-signed cert. Delete this line in production.
    ServerCertificateCustomValidationCallback =
        HttpClientHandler.DangerousAcceptAnyServerCertificateValidator,
};
using var client = new HttpClient(handler) { Timeout = TimeSpan.FromMinutes(2) };
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

var token = await GetTokenAsync(client);
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

var originalDesc = (await GetItemAsync(client, ItemId))["ItemDesc"]?.ToString();

foreach (var symbol in CandidateSymbols)
{
    var allowed = await SymbolRoundTripsAsync(client, ItemId, symbol);
    Console.WriteLine($"\"{symbol}\": {(allowed ? "allowed" : "discarded")}");
}

// Restore the original description
var part = await GetItemAsync(client, ItemId);
part["ItemDesc"] = originalDesc;
await client.PutAsync(
    $"{BaseUrl}/api/inventory/parts/{ItemId}",
    new StringContent(part.ToJsonString(), Encoding.UTF8, "application/json"));
var restored = (await GetItemAsync(client, ItemId))["ItemDesc"]?.ToString();
Console.WriteLine($"Restored: {restored == originalDesc}");

// --- helpers ---------------------------------------------------------------

static async Task<JsonNode> GetItemAsync(HttpClient client, string itemId)
{
    var resp = await client.GetAsync(
        $"{BaseUrl}/api/inventory/parts/{itemId}?extendedproperties={ExtendedProps}");
    resp.EnsureSuccessStatusCode();
    return JsonNode.Parse(await resp.Content.ReadAsStringAsync())!;
}

// Probe whether a symbol survives a round-trip (PUT then GET).
static async Task<bool> SymbolRoundTripsAsync(HttpClient client, string itemId, string symbol)
{
    var part = await GetItemAsync(client, itemId);
    var test = $"AA{symbol}BB";
    part["ItemDesc"] = test;
    await client.PutAsync(
        $"{BaseUrl}/api/inventory/parts/{itemId}",
        new StringContent(part.ToJsonString(), Encoding.UTF8, "application/json"));
    var after = (await GetItemAsync(client, itemId))["ItemDesc"]?.ToString();
    return after == test; // true => allowed; baseline value => silently discarded
}

// v2 token endpoint — credentials go in the body, never in headers.
static async Task<string> GetTokenAsync(HttpClient client)
{
    var payload = JsonSerializer.Serialize(new { username = Username, password = Password });
    var response = await client.PostAsync(
        $"{BaseUrl}/api/security/token/v2",
        new StringContent(payload, Encoding.UTF8, "application/json"));
    response.EnsureSuccessStatusCode();
    return ReadField(await response.Content.ReadAsStringAsync(), "AccessToken");
}

// Some middleware answers this endpoint in XML even when asked for JSON.
static string ReadField(string payload, string field)
{
    try
    {
        var value = JsonDocument.Parse(payload).RootElement.GetProperty(field).GetString();
        if (!string.IsNullOrEmpty(value)) return value;
    }
    catch (Exception ex) when (ex is JsonException or KeyNotFoundException) { }

    var match = System.Text.RegularExpressions.Regex.Match(payload, $"<{field}>([^<]+)</{field}>");
    if (!match.Success)
        throw new InvalidOperationException(
            $"No {field} in response: {payload[..Math.Min(200, payload.Length)]}");
    return match.Groups[1].Value;
}