POST

Order.Catalog

List catalog orders from the orders table (Settings → Order step 1/4: Id, Name, Price, Min days). Same source as dashboard get_order_list. Default order_type=without_date matches the customer add-order product picker. Send order_type=all for the full Settings list (ids like 24, 29). Alias: Order.Products. Requires module_orders. Not the same as Order.List (customer order rows).

Permissions

  • User must be logged in with a valid bearer token.
  • The user must be from the same company domain as the request Host (call the API on that account subdomain or allowed custom domain). A token from another company returns success=0, error user_not_in_company.
  • Returned or changed records are limited by the user permissions, team access, folder access, and account settings.

Action

  • Runs the Order.Catalog function and returns JSON.

Push Service

No push is sent because this function only reads data or returns helper information.

Automation

No automation is run for this function.

Special Instructions

  • On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
  • Settings Order modal (screenshot list): POST /app/Order.Catalog with order_type=all.
  • Add-order modal product dropdown: omit order_type or send without_date (default).
  • Single catalog row: Order.Catalog.Get with id=24.
  • Customer profile order lines: use Order.List / Order.Get (orders_for_cust).

Required Parameters

No body parameters are required for this function.

Optional Parameters

NameTypeSampleWhat it gives
order_type
post
stringallFilter catalog rows. Default without_date. Use all (or *) for every Settings Order row like the dashboard modal.

Authentication

Send the bearer token returned by Login in the request header. The user must be from the same company domain as this Host — a token from another company is rejected (user_not_in_company).

Authorization: Bearer YOUR TOKEN

Sample Request

{
    "url": "\/app\/Order.Catalog",
    "method": "POST",
    "headers": {
        "Authorization": "Bearer YOUR TOKEN"
    },
    "body": {
        "order_type": "all"
    },
    "url_user": "https:\/\/{user}.bull36.com\/app\/Order.Catalog",
    "url_domain": "https:\/\/{domain}\/app\/Order.Catalog"
}

Endpoint

POST /app/Order.Catalog
POST https://{user}.bull36.com/app/Order.Catalog
POST https://{domain}/app/Order.Catalog

Sample Output

{
    "success": 1,
    "count": 2,
    "order_type": "all",
    "show_order_on_header": 1,
    "data": [
        {
            "id": 24,
            "order_id": 24,
            "name": "הזמנה - מפיקה",
            "price": "0",
            "min_days": 1,
            "order_type": "without_date"
        },
        {
            "id": 29,
            "order_id": 29,
            "name": "הזמנה - מרכזות",
            "price": "0",
            "min_days": 1,
            "order_type": "without_date"
        }
    ]
}

JavaScript Example

const token = 'YOUR TOKEN';
const body = new URLSearchParams({ order_type: 'all' });
const res = await fetch('/app/Order.Catalog', { method: 'POST', headers: { Authorization: 'Bearer ' + token }, body });
console.log(await res.json());

Error Example

{
    "success": 0,
    "error": "permission_denied",
    "message": "permission denied"
}