---
title: "Depot distributors public"
description: "Every distributors public operation in the Depot API, with parameters, responses and code samples in six languages."
url: "https://support.outpostplatform.com/api/generated/depot/distributorspublic/"
product: "depot"
type: "reference"
status: "reviewed"
last_reviewed: 2026-11-06
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/api/generated/depot/distributorspublic.mdx"
license: "CC BY 4.0"
---

# Depot distributors public

Registers the public distributor routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

### POST `/api/v1/public/distributors/{vendor}/webhook/{pathToken}` {#depot.distributorsPublic.webhook}

**distributorWebhook verifies and stores a distributor's push notification.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `pathToken` | path | string | Yes |  |
| `vendor` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, object | Success. |
| `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. |
| `401` | `application/problem+json`, ProblemDetails | The notification could not be verified. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches. |
| `413` | `application/problem+json`, ProblemDetails | The notification is too large. |
| `429` | `application/problem+json`, ProblemDetails | Too many requests. Try again in a minute. |
| `500` | `application/problem+json`, ProblemDetails | The request failed. |
| `503` | `application/problem+json`, ProblemDetails | This Depot cannot take distributor notifications yet. |

#### Request samples

```bash
# This operation is public. It takes no credentials.
curl -X POST 'https://depot.example.com/api/v1/public/distributors/<vendor>/webhook/<pathToken>' \
  -H 'Accept: application/json'
```

```powershell
# This operation is public. It takes no credentials.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/public/distributors/<vendor>/webhook/<pathToken>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# This operation is public. It takes no credentials.

import requests

url = "https://depot.example.com/api/v1/public/distributors/<vendor>/webhook/<pathToken>"
headers = {
    "Accept": "application/json",
}

response = requests.post(url, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// This operation is public. It takes no credentials.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/public/distributors/<vendor>/webhook/<pathToken>", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("Accept", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// This operation is public. It takes no credentials.

const url = "https://depot.example.com/api/v1/public/distributors/<vendor>/webhook/<pathToken>";

const response = await fetch(url, {
	method: "POST",
	headers: {
		"Accept": "application/json",
	},
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// This operation is public. It takes no credentials.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/public/distributors/<vendor>/webhook/<pathToken>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### POST `/api/v1/public/punchout/{token}/return` {#depot.distributorsPublic.punchoutReturn}

**punchoutReturn turns the PunchOutOrderMessage the browser posts into a draft purchase order and sends the browser to it (303).**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `token` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | None | Success. The body shape was not resolved; see x-outpost-unresolved. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |
| `429` | `application/problem+json`, ProblemDetails | Too many requests. Try again in a minute. |

#### Request samples

```bash
# This operation is public. It takes no credentials.
curl -X POST 'https://depot.example.com/api/v1/public/punchout/<token>/return' \
  -H 'Accept: application/json'
```

```powershell
# This operation is public. It takes no credentials.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/public/punchout/<token>/return' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# This operation is public. It takes no credentials.

import requests

url = "https://depot.example.com/api/v1/public/punchout/<token>/return"
headers = {
    "Accept": "application/json",
}

response = requests.post(url, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// This operation is public. It takes no credentials.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/public/punchout/<token>/return", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("Accept", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// This operation is public. It takes no credentials.

const url = "https://depot.example.com/api/v1/public/punchout/<token>/return";

const response = await fetch(url, {
	method: "POST",
	headers: {
		"Accept": "application/json",
	},
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// This operation is public. It takes no credentials.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/public/punchout/<token>/return");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```