---
title: "Import suppliers and their primary contacts from a CSV"
method: POST
path: "/api/v1/inventory/suppliers/upload"
tags: ["suppliers"]
---

# Import suppliers and their primary contacts from a CSV

`POST /api/v1/inventory/suppliers/upload`

## Request

- Base URL: `https://api.app.tightly.io`
- URL: `https://api.app.tightly.io/api/v1/inventory/suppliers/upload`
- Auth: HTTP bearer

Uploads a CSV of suppliers and their primary contacts. Send it as `multipart/form-data` under the field name `file`, with a content type of `text/csv` or `text/plain`; the delimiter is sniffed rather than assumed, so a semicolon or a tab file is read as readily as a comma one.

Required columns: `supplier_id`, `supplier_name`, `contact_name`, `contact_email`, `contact_phone`. Any other column the importer knows is optional. Rows with no `supplier_id` are dropped and duplicate `supplier_id`s are collapsed to the first.

The `supplier_id` here is yours, which is what separates this from create_supplier: that call derives an id from the name, this one keeps the id your system of record already uses.

It answers 200 with `{"status": "success"}`, not the `{message, data}` envelope every other operation answers. A missing file, an unsupported content type, a missing required column, an unreadable file or one that is empty after filtering is refused 400.

Scope: `suppliers:write`, which includes `suppliers:read`.

## Headers

- `Tightly-Version` string
- `Idempotency-Key` string

## Response `200`

The file was read and its rows were written. Not the standard envelope.

- object
  - `status` string

## Other responses

- `400`: No file, a content type that is not `text/csv` or `text/plain`, a missing required column, a file that cannot be parsed, or a file with no usable row. The first two answer `{"error": ...}` from the route itself; the rest answer the platform's error envelope.
- `401`: No usable key: malformed, unknown, revoked, expired or stopped. One refusal covers all five, telling a caller which is which maps the surface for them. A request with no Authorization header at all is refused 400 before any key is looked for.
- `403`: The key may not reach this operation. `scope_missing` when the key does not hold Suppliers; `ip_not_allowed` when the caller's address is outside the key's allowlist. There is no `organization_mismatch` on this resource: no supplier or contact route names an organisation in its path, so there is nothing for a key to disagree with.
- `429`: The key has spent its allowance for this minute. 600 reads and 120 writes a minute, counted per key, refused calls included. `Retry-After` says how long to wait.
- `503`: The database is briefly out of reach, which is what a failover or a full connection pool looks like from outside. Wait the seconds `Retry-After` names and send the request again. A read is safe to repeat. A write is not, because the connection was lost in the middle of it, so read the object back before sending it a second time. Branch on the status rather than on `code`, which is `POSTGRES_UNAVAILABLE` from one of the two seams that raise this and `SERVICE_UNAVAILABLE` from the other.

---

[API](https://skmtc.dev/tightly/apis/tightly-api.md) · [All operations](https://skmtc.dev/tightly/apis/tightly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tightly/apis/tightly-api/revisions/199f7eb35afb?raw)