Skip to main content
POST
Atomically apply one or more edits to an existing order

Authorizations

Authorization
string
header
required

Bearer token authentication. Accepts company tokens, partner tokens, public tokens, droplet installation tokens, and user_company tokens. The authenticated credential determines editor_type and editor_id on the resulting order-edit audit records — the payload never carries either field.

Headers

Idempotency-Key
string

Optional client-generated key (UUID recommended) that the server uses to deduplicate retries. The first request with a given key executes normally; subsequent requests with the same key return the cached response with X-Idempotent-Replayed: true for 24 hours. A concurrent retry while the first is still in flight returns HTTP 409. The cache is scoped to the authenticated company.

Maximum string length: 255

Path Parameters

order_id
integer
required

Primary-key id of the order to edit. Must belong to the authenticated company; an unknown id or an order owned by another company returns 404.

Body

application/json
operations
object[]
required

One or more edit operations to apply atomically. The whole transaction commits or rolls back together.

Minimum array length: 1
expected_updated_at
string<date-time>

Optional optimistic-concurrency guard. When provided, the server compares against the order's current updated_at before applying any operations and returns HTTP 409 with the current value on mismatch. Pass the ISO-8601 string received in a prior order response verbatim. Callers that don't load the order first can omit this and bypass the check.

Response

Edit applied successfully. Returns the updated order.

Order response wrapper. The order object includes the eight recalculated current_* totals plus the adjustments array. Edit history is not exposed through this API.

order
object
required

The edited order, including the eight recalculated current_* totals and its adjustments.

status
integer
required

HTTP status code, repeated in the body (200 on success).

meta
object
required

Response metadata (request_id and timestamp).