# Create a label template

Request a temporary secure path for printing one or more orders.

Company: Metfone Express
API version: v1
Requested language: en
Content language: en
Source: https://mfexpress-partner-docs.zhst.app/mfexpress/en/create-label

Endpoint: POST /order/label/presigned


```http
POST /tms-partner/api/v1/order/label/presigned
```

## Usage and important notes

Use order IDs returned by creation. Both label endpoints use the **same TMS Partner base URL** as every other operation. Always provide `labelId` and `orderIds`, even though the current code lacks required-field validation and missing values can fail at runtime instead of returning a clear 400.

`setting.maskContact`, if omitted, the system configuration applies. `sellerAsShipper=true` displays the seller rather than the warehouse. `securePath` is the next endpoint’s `source-path`; `exp` is a Unix millisecond timestamp. Fetch and print before it expires.

## Authentication headers



| Header | Requirement | Value / meaning |
| --- | --- | --- |
| X-Api-Token | Required | `${API_TOKEN}`: environment-specific token issued by TMS |
| X-Client-Source | Required | `${PARTNER_CODE}`: partner code paired with the token |
| Content-Type | With a JSON body | application/json |
| Accept | Required by source | application/json |
| Accept-Language | Optional | `vn`, `en`, `my`, `km`, `lo` |



## Request fields

Always supply labelId and orderIds. Current code does not enforce requiredness and omissions can cause runtime errors.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `labelId` | string | Yes | Print format examples: a5, a6, a7; full enum is not supplied. |
| `orderIds` | array | Yes | IDs returned by create-order. |
| `setting` | object | See description | Optional print settings. |
| `setting.copy` | number | See description | Copies per order. |
| `setting.hideFees` | boolean | See description | Hide fees on the label. |
| `setting.sellerAsShipper` | boolean | See description | Show seller name instead of warehouse. |
| `setting.maskContact` | boolean | See description | Partially hide phone/contact details; defaults to system configuration. |



## Example JSON body

Save as `request.json`. Replace every `${…}` string and example ID with actual environment values before sending. cURL with `--data @request.json` **does not interpolate variables inside JSON files**. Identities are synthetic.
```json
{
  "labelId": "a7",
  "orderIds": [
    "EXAMPLE-ORDER-001"
  ],
  "setting": {
    "copy": 1,
    "hideFees": false,
    "sellerAsShipper": true,
    "maskContact": false
  }
}
```


## cURL example

`BASE_URL` must include `/tms-partner/api/v1`. Load the token and partner code from your private environment; never paste secrets into documentation or AI prompts.
```bash
curl --request POST "${BASE_URL}/order/label/presigned" \
  --header "X-Api-Token: ${API_TOKEN}" \
  --header "X-Client-Source: ${PARTNER_CODE}" \
  --header "Accept-Language: en" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data @request.json
```


## Example response

```json
{
  "securePath": "00000000-0000-4000-8000-000000000002",
  "exp": 1791972000000
}
```


## Response fields



| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `securePath` | string | See description | Temporary secure token used as source-path. |
| `exp` | number | See description | Expiry as Unix timestamp in milliseconds; fetch before expiry. |



## Error handling

See [HTTP codes and source limitations](reference). HTTP success does not prove COD, fees, or cancellation are correct; inspect the documented business fields. Do not assume create-order retries are safe.