Documentation
ShipLabel
REST API

ShipLabel REST API

ShipLabel registers a REST API namespace: /wp-json/shiplabel/v1/.

Endpoints

EndpointMethodDescription
/orders/{order_id}/generatePOSTGenerate a label for an order
/orders/{order_id}/labelsGETList all labels for an order, each with a signed download_url
/labels/{label_id}/voidDELETECancel a label with the carrier and delete its local file
/labels/{label_id}DELETEPermanently delete a label record. Only cancelled labels can be deleted
/labels/{label_id}/trackingGETTracking events saved for a label so far
/labels/{label_id}/downloadGETDownload the label file (requires the signed token from download_url)
/validate-addressPOSTValidate an address with USPS or FedEx
/ratesPOSTGet a rate quote for a package

Generate a Label

POST /orders/{order_id}/generate

ParameterTypeRequiredDescription
carrierstringYesusps or fedex
weight_oznumberYesPackage weight in ounces
servicestringNoService code, e.g. PRIORITY_MAIL or FEDEX_2_DAY. Defaults to the carrier's default service
length, width, heightnumberNoInches. Default 1
package_typestringNopackage (default), or for USPS FLAT_RATE_ENVELOPE, FLAT_RATE_BOX_SMALL, FLAT_RATE_BOX_MEDIUM, FLAT_RATE_BOX_LARGE
item_idsarrayNoOrder item IDs in this package. Default: all physical items
mark_fulfilledbooleanNoMark the WooCommerce Fulfillment as fulfilled. Default false

Returns 201 with the label (carrier, service, tracking_number, postage_cost, label_id, fulfillment_id, download_url), or 422 with an error message.

Rates

POST /rates takes carrier, weight_oz, optional length/width/height, service and package_type, plus either order_id (the destination is read from the order) or to_zip. from_zip defaults to your shipper ZIP. The response is the carrier's rate data.

Validate Address

POST /validate-address takes carrier (usps or fedex) and an address object with address1, address2, city, state, zip and, for FedEx, country.

Authentication

All endpoints require an authenticated WordPress user with the manage_woocommerce capability - a logged-in session with a REST nonce, or Application Passwords. There is no separate API key.

This is separate from the tracking webhook, which is a plain (non-REST) endpoint with its own optional signature check.