# Look up catalog items by SKU

Fast exact-SKU lookup within a catalog. Returns a lightweight projection; use *Get a catalog item* for the full record.

Endpoint: POST /v1/catalog_items/sku-lookup
Version: 1.19
Security: ApiKey, ApiSecret, UserGuid, UserToken, SupplierGuid

## Security:

  - `ApiKey` (unknown)
    apiKey in header x-apiKey

  - `ApiSecret` (unknown)
    apiKey in header x-apiSecret

  - `UserGuid` (unknown)
    apiKey in header userGuid

  - `UserToken` (unknown)
    apiKey in header userToken

  - `SupplierGuid` (unknown)
    apiKey in header supplierGuid

## Request fields (application/json):

  - `catalogGuid` (string, required)

  - `skuName` (string, required)
    Exact SKU to match (case-insensitive, trimmed).
    Example: WIDGET-001

## Response 200:

  - `200` (unknown)
    Matching items (empty array when none).

## Response 200 fields (application/json):

  - `catalog_items` (array, required)

  - `catalog_items.id` (integer)

  - `catalog_items.name` (string)

  - `catalog_items.sku` (string)

  - `catalog_items.description` (string)

  - `resource` (string, required)
    Example: catalog_items

## Response 400:

  - `400` (unknown)
    The request is malformed or references a resource the supplier does not own (for example an unknown catalog GUID).

## Response 400 fields (application/json):

  - `message` (string, required)
    Human-readable error message.
    Example: Invalid Catalog GUID

  - `error` (string)
    Underlying error detail, when available.

  - `code` (string)
    Machine-readable code for specific failures (for example `INVALID_DELTA_CURSOR`).

## Response 401:

  - `401` (unknown)
    Missing or invalid credentials.

## Response 401 fields (application/json):

  - `message` (string, required)
    Human-readable error message.
    Example: Invalid Catalog GUID

  - `error` (string)
    Underlying error detail, when available.

  - `code` (string)
    Machine-readable code for specific failures (for example `INVALID_DELTA_CURSOR`).

## Response 403:

  - `403` (unknown)
    The credentials are valid but the user lacks the access level this endpoint requires.

## Response 403 fields (application/json):

  - `message` (string, required)
    Human-readable error message.
    Example: Invalid Catalog GUID

  - `error` (string)
    Underlying error detail, when available.

  - `code` (string)
    Machine-readable code for specific failures (for example `INVALID_DELTA_CURSOR`).

## Response 500:

  - `500` (unknown)
    Unexpected server error. Some legacy endpoints return the message as `text/plain` instead of JSON.

## Response 500 fields (application/json):

  - `message` (string, required)
    Human-readable error message.
    Example: Invalid Catalog GUID

  - `error` (string)
    Underlying error detail, when available.

  - `code` (string)
    Machine-readable code for specific failures (for example `INVALID_DELTA_CURSOR`).