diff --git a/src/app/api/v1/stock/items/set-pricing/route.ts b/src/app/api/v1/stock/items/set-pricing/route.ts
index 47d410d..37ec318 100644
--- a/src/app/api/v1/stock/items/set-pricing/route.ts
+++ b/src/app/api/v1/stock/items/set-pricing/route.ts
@@ -44,9 +44,22 @@ export async function POST(req: Request) {
     );
   }
 
-  const updates = body.updates.map((u, i) => {
-    if (typeof u.id !== "string" || !PB_ID_RE.test(u.id)) {
-      throw new Error(`updates[${i}].id must be a 15-char PB id`);
+  const updates: Array<{
+    id: string;
+    costPrice?: number;
+    sellingPrice?: number;
+    markup?: number;
+  }> = [];
+  for (let i = 0; i < body.updates.length; i++) {
+    const u = body.updates[i];
+    if (!u || typeof u.id !== "string" || !PB_ID_RE.test(u.id)) {
+      return NextResponse.json(
+        {
+          code: "validation_error",
+          message: `updates[${i}].id must be a 15-char PB id`,
+        },
+        { status: 400 },
+      );
     }
     const out: { id: string; costPrice?: number; sellingPrice?: number; markup?: number } = {
       id: u.id,
@@ -54,8 +67,8 @@ export async function POST(req: Request) {
     if (u.costPrice !== undefined) out.costPrice = Number(u.costPrice);
     if (u.sellingPrice !== undefined) out.sellingPrice = Number(u.sellingPrice);
     if (u.markup !== undefined) out.markup = Number(u.markup);
-    return out;
-  });
+    updates.push(out);
+  }
 
   let pb;
   try {