Fields
Needs FFL orders: Read and write, a permission of FFL Checkout stores. The order number goes in the address: the one you reported the order with, so the transfer joins it. It may also come first. The body is the whole transfer as it stands, sent after every change, the way FFL Monkey's checkout plugin reports the transfers it runs.
| Field | Type | Rule |
|---|---|---|
| transfer_coderequired | string | Your reference for the transfer, the one your emails and documents show. Up to 40 characters. |
| statusrequired | string | Where it stands, in lowercase letters, digits and underscores, up to 24, kept as sent. Use the checkout plugin's where they fit, which your FFL Monkey screens know: needs_dealer, licence_uploaded, licence_unusable, needs_email, needs_request, waiting_dealer, declined, check_licence, form3_pending, ready_to_ship, shipped, received, pickup_form4, pickup_waiting, pickup_ready, collected, closed. |
| waits_onrequired | string | Who the next step waits on: merchant, dealer, buyer, atf or nobody. |
| needs_sotoptional | boolean | Whether an item needs a dealer with an SOT (NFA items). Default false. |
| orderoptional | object | The order, as your system has it: id, number, status, currency, total (a decimal string) and created_at. |
| buyeroptional | object | first_name, last_name, email, phone, and the billing and shipping addresses, each line1, line2, city, state, postcode and country. |
| dealeroptional | object or null | The dealer it goes to: option (how the buyer chose: pick, upload, defer or store), license_number in any form, name, address, phone, email, request_email (where the request went), expiration_date, sot_class, contribution_id (an upload's id), registry_id, verified, transfers_verified and transfer_confirmed. |
| itemsoptional | array | The order's lines, up to 200. |
| items[].product_idoptional | integer | Your product's id. |
| items[].variation_idoptional | integer | Its variation's, if any. |
| items[].skuoptional | string | Up to 100 characters. |
| items[].nameoptional | string | Up to 255 characters. |
| items[].quantityoptional | integer | How many. |
| items[].totaloptional | string | The line total, a decimal string. |
| items[].requires_ffloptional | boolean | Whether it goes through a dealer. |
| items[].requires_sotoptional | boolean | Whether its dealer needs an SOT. |
| eventsrequired | array | Every event so far, 1 to 200. Send them all every time: each is kept once, by its id. |
| events[].idrequired | string | A UUID of yours, one per event. |
| events[].typerequired | string | What happened, in lowercase letters, digits and underscores, such as placed, request_sent, accepted, declined, licence_checked, form3_approved, shipped or received. |
| events[].atrequired | string | When, in UTC, such as 2026-10-10T14:02:00Z. |
| events[].actorrequired | string | buyer, dealer, merchant or system. |
| events[].nameoptional | string | The person, when known. |
| events[].detailoptional | object | Anything else about it, up to 20 entries, such as a shipment's serial numbers. |
- Safe to repeat. The state is replaced by what you send, and only events with new ids are added.
- The buyer is merged field by field. A field you leave out, an empty state or country, or a value WooCommerce anonymised (such as
[deleted]or[email protected]) keeps what FFL Monkey holds, and any other value, an empty one included, replaces it. To remove a buyer's details, contact [email protected]. - Buyer details are kept for the transfer record, shown in your FFL Monkey screens and to FFL Monkey's staff. Nothing about a transfer is sent to a webhook.
- An
acceptedevent by the dealer teaches FFL Monkey's registry that the dealer takes transfers. - The order number in the address follows the same rules as a reported
ref. The body is checked first.
What it answers
data is the transfer as kept, never the buyer details it holds:
| Field | Meaning |
|---|---|
| ref | Your order number, as sent. |
| transfer_code | As sent. |
| status | As sent. |
| waits_on | As sent. |
| needs_sot | As sent. |
| dealer_license_key | The dealer's licence without its expiry group, or null when there is none or it cannot be read. |
| dealer_resolved | Whether it names a dealer in FFL Monkey's registry. |
| events | How many events are kept. |
| reported_at | When it was last reported. |
| buyer_erased_at | When FFL Monkey's support erased the buyer's details at your request, or null. |
Returns
- 200Kept: the transfer as it now stands, in
data. - 422validation_failed: the body broke a rule, or the order number in the address is not one, or is a WooCommerce order key.
This endpoint can also answer 401 invalid_api_key, 403 license_not_active, 403 product_not_included, 403 insufficient_scope and 429 rate_limited.