Beta

The Partner Trading API v1 is in beta — endpoints and response shapes may still change.

Developers
Cru World Wine
API v1 · REST & MCP
Your bids

Change a bid

Change the price, quantity, local_only or auto_transfer of one of your live Cru bids. Any change, even to an option alone, runs it for 90 days from then.

PATCH/bids/{code}LIVE
Required scopebids:writeAuthentication required

How this write runs

bid.update
Partner credentialCLIENT-KEY · CLIENT-SECRET Executes at once and answers 200. The body must carry a reference: send the identical request again after a timeout and Cru replays the first outcome instead of acting twice.
Connected appAuthorization: Bearer Answers 202 with a confirmation code and does nothing else. It runs only when the app calls POST /confirmations/{code} within 15 minutes, after the customer agrees.

Writes & confirmations, in full →

Path parameter

REQUIRED
codestringThe bid’s opaque code, from GET /bids. URL-encode it as a single path segment.

Request body

APPLICATION/JSON
FIELDDESCRIPTION
referencestring · 1–50 chars · partners: requiredYour idempotency key: letters and digits, then . _ : or - allowed. Required on a partner credential’s write and kept for good, so a retry with it can never act twice. Ignored for connected apps.
pricenumber · > 0 · optionalNew gross price per unit, in your market’s currency, as GET /bids quotes it. Any change moves the bid into that currency, as an edit on Cru does, so its market and bid_currency become yours.
quantityinteger · 1–1000 · optionalNew quantity. A quantity alone keeps the price GET /bids quotes.
local_onlyboolean · optionalAccept only stock already on this Cru site. Omit to keep it.
auto_transferboolean · optionalMove the wine into your storage on this site when the bid fills. Omit to keep it.

Any other field is refused with VALIDATION_UNKNOWN_PARAMETER / 400.

What cannot be changed

A partly matched bid, a bid that is no longer live, and a bid from another venue are refused with TRADE_REFUSED. So is a price above the cheapest offer in whole units, even when you change only an option: under an offer at 1,721.50, 1,721 is the most. Buy that offer instead.

Response fields

200 OK · 202 Accepted

A partner credential gets 200 and the changed bid, now on the market you called and in its currency. A connected app gets 202 and a confirmation whose preview shows before and after, in your market’s currency.

Executed 200

actionstring

The action that ran, such as bid.place.

statusstring

completed.

bidobject

The bid as it now is.

Staged 202

confirmation.codestring

cnf_ and 43 more characters. A secret: the only handle on the instruction, valid for 15 minutes, once.

confirmation.actionstring

The action staged, such as bid.place.

confirmation.statusstring

pending.

confirmation.expires_atdatetime

RFC 3339 UTC.

confirmation.previewobject

summary, code, lwin18, wine_name, before and after — each price, quantity, local_only and auto_transfer — total and currency.

Errors

A body with none of price, quantity, local_only and auto_transfer returns VALIDATION_REQUIRED_FIELD / 422, naming price. A code that is not one of your bids returns BID_NOT_FOUND / 404. A total over your bidding allowance, or a market whose bids are placed in a currency it does not quote in, returns TRADE_REFUSED / 422. If the bid’s price, quantity or options changed elsewhere after it was read, the answer is PRICE_CHANGED / 409. Missing or invalid credentials return AUTH_INVALID_CREDENTIALS / 401. A credential without bids:write gets AUTH_INSUFFICIENT_SCOPE / 403. View all error codes →

UP NEXT Cancel a bid

API credentials

Enter the client key and secret issued by Cru. They are kept for this browser tab’s session — a reload keeps them, closing the tab or clearing them ends them.

Credentials are never included in copied examples, and are redacted from anything the console prints back.

Request API access

Tell us who you are and what you want to build. Cru issues a client key and secret for your organisation, scoped to what you need.

Markets you trade in (choose one or more)

We use what you send here to reply about API access, and for nothing else. Cloudflare Turnstile checks the form for bots (privacy policy).