curl --request PATCH \
--url https://{host}/v1/sellers/{sellerId}/orders/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "orders",
"id": "7741",
"attributes": {
"courier": "dhl",
"trackingNumber": "JVGL09100000001"
}
}
}
'const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'orders',
id: '7741',
attributes: {courier: 'dhl', trackingNumber: 'JVGL09100000001'}
}
})
};
fetch('https://{host}/v1/sellers/{sellerId}/orders/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/sellers/{sellerId}/orders/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'orders',
'id' => '7741',
'attributes' => [
'courier' => 'dhl',
'trackingNumber' => 'JVGL09100000001'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/sellers/{sellerId}/orders/{id}"
payload = { "data": {
"type": "orders",
"id": "7741",
"attributes": {
"courier": "dhl",
"trackingNumber": "JVGL09100000001"
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/vnd.api+json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text){
"data": {
"type": "orders",
"id": "7741",
"attributes": {
"number": "202610100",
"status": "in_transit",
"total": 1297500,
"courier": "dhl",
"trackingNumber": "JVGL09100000001",
"trackingUrl": "https://www.dhl.com/nl-en/home/tracking/tracking-parcel.html?submit=1&tracking-id=JVGL09100000001",
"shippedAt": "2026-09-22T06:15:30.000000Z",
"updatedAt": "2026-09-22T06:15:30.000000Z"
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}Ship order
Scope: orders:write
trackingNumber is required. Spaces are taken out and letters made capitals, as
it is stored. The order moves to in_transit and the buyer is told — unless it is
one you are bringing to us in person, which is already on its way.
courier must be one we know. GET /v1/couriers lists them with the names the
dashboard shows, other last for one we do not have; generate your picker from
that rather than hard-coding it, because we add carriers. Leave it out and we
recognise it from the number; when the number could belong to more than one
courier, or to none we know, that is a 422 on courier.
trackingUrl is the link the buyer’s shipping email and order page send them to.
Leave it out and we build it for a courier whose buildsTrackingUrl is true,
using the order’s shipping address where the carrier needs the postcode (PostNL,
Trunkrs, Mondial Relay). For other, a courier we have no link for, or an
address without the postcode it needs, it is required: a 422 on trackingUrl.
One you send is kept as it is.
A shipment is described whole each time: what you leave out is worked out again from the number, not kept from before. So a corrected number sent alone does not keep the courier and link of the parcel it replaces.
Recorded for an order that is paid and not sent yet: payment_received, or one you
are bringing to us in person that has no tracking yet. Changed while it is on its
way: in_transit — the buyer gets the new link, but only when something changed —
or awaiting_delivery with tracking, which tells nobody. Any other status (once
it is delivered, completed, cancelled, refunded or returned) is refused with 409
and order_not_shippable, meta.status saying which it is.
Every other attribute of an order is the record of what happened: any attribute but
courier, trackingNumber and trackingUrl is refused with 403
(read_only_field), source.pointer naming it.
curl --request PATCH \
--url https://{host}/v1/sellers/{sellerId}/orders/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "orders",
"id": "7741",
"attributes": {
"courier": "dhl",
"trackingNumber": "JVGL09100000001"
}
}
}
'const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'orders',
id: '7741',
attributes: {courier: 'dhl', trackingNumber: 'JVGL09100000001'}
}
})
};
fetch('https://{host}/v1/sellers/{sellerId}/orders/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/sellers/{sellerId}/orders/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'orders',
'id' => '7741',
'attributes' => [
'courier' => 'dhl',
'trackingNumber' => 'JVGL09100000001'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/sellers/{sellerId}/orders/{id}"
payload = { "data": {
"type": "orders",
"id": "7741",
"attributes": {
"courier": "dhl",
"trackingNumber": "JVGL09100000001"
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/vnd.api+json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text){
"data": {
"type": "orders",
"id": "7741",
"attributes": {
"number": "202610100",
"status": "in_transit",
"total": 1297500,
"courier": "dhl",
"trackingNumber": "JVGL09100000001",
"trackingUrl": "https://www.dhl.com/nl-en/home/tracking/tracking-parcel.html?submit=1&tracking-id=JVGL09100000001",
"shippedAt": "2026-09-22T06:15:30.000000Z",
"updatedAt": "2026-09-22T06:15:30.000000Z"
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}Authorizations
Headers
Optional. A UUID per logical operation, not per attempt: a retry carrying the same key gets the first attempt's answer back, headers and all, rather than performing the write twice. Honoured for 24 hours.
A refusal is an answer. A 422 is remembered like any other, so sending a
corrected body under the same key answers 422 idempotency_key_reuse rather
than accepting the correction — the point of a key is that one key means one
decision. Use a new key for a new attempt at the request, and keep the old one
only for retrying the same bytes after a timeout.
A 5xx is the exception: nothing was decided, so the key is released and the
same one may be retried.
| Refusal | Status | code |
|---|---|---|
| The same key with a different body | 422 | idempotency_key_reuse |
| The first request with this key is still running | 409 | idempotency_in_progress |
| The key's record vanished between two requests: retry with a new key | 409 | idempotency_conflict |
| A key longer than 191 characters | 400 | idempotency_key_invalid |
A replayed answer carries Idempotent-Replay: true.
191