Skip to main content
POST
Atomically apply one or more edits to an existing order

Authorizations

Authorization
string
header
required

Bearer token authentication. Accepts company tokens, partner tokens, public tokens, droplet installation tokens, and user_company tokens. The authenticated credential determines editor_type and editor_id on the resulting order-edit audit records — the payload never carries either field.

Headers

Idempotency-Key
string

Optional client-generated key (UUID recommended) that the server uses to deduplicate retries: a stored response replays for up to 24 hours. An edit whose outcome is unknown holds its key until support resolves it, and every retry under it answers 409 until then; once support resolves it, the key stays held for 24 hours if the edit took effect, or can be used again if it did not. The key is bound to the exact request that first used it: the method, path and query string, Content-Type and body bytes, and the editor the edit is attributed to. A retry must resend that request unchanged, byte for byte, and then replays the first response with X-Idempotent-Replayed: true. Any other request under the key answers 422 and does not run; use a new key only for a new request. A client that cannot reproduce the original request should read the order to confirm the outcome rather than retry under a new key. A concurrent retry while the first is still in flight returns 409. The cache is scoped to the authenticated company. A key must not end with :lock, which is reserved; such a key answers 422 and the edit does not run. A response already cached under such a key, from before the suffix was reserved, still replays on a retry of its request.

Maximum string length: 255

Path Parameters

order_id
integer
required

Primary-key id of the order to edit. Must belong to the authenticated company; an unknown id or an order owned by another company returns 404.

Body

application/json
operations
object[]
required

One or more edit operations to apply atomically. The whole transaction commits or rolls back together.

Minimum array length: 1
expected_updated_at
string<date-time>

Optional optimistic-concurrency guard. When provided, the server compares against the order's current updated_at before applying any operations and returns HTTP 409 with the current value on mismatch. Pass the ISO-8601 string received in a prior order response verbatim. Callers that don't load the order first can omit this and bypass the check.

Response

Edit applied successfully. Returns the updated order.

Order response wrapper. The order object includes the eight recalculated current_* totals plus the adjustments array. Edit history is not exposed through this API.

order
object
required

The edited order, including the eight recalculated current_* totals and its adjustments.

status
integer
required

HTTP status code, repeated in the body (200 on success).

meta
object
required

Response metadata (request_id and timestamp).