---
title: "Schwab Place Order"
method: POST
path: "/api/admin/schwab/portfolio/{account_hash}/orders"
tags: ["admin"]
---

# Schwab Place Order

`POST /api/admin/schwab/portfolio/{account_hash}/orders`

## Request

- Base URL: `https://api.equity-rank.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.equity-rank.com/api/admin/schwab/portfolio/{account_hash}/orders`
- Auth: HTTP bearer

Place an order on a Schwab account (legacy wheel-CSP shortcut).

GUARD-03: this legacy endpoint writes the immutable order_audit_log on every
state transition (DRAFT before send; SENT or REJECTED after), reusing the
Phase 23 _insert_audit_row / _supabase_audit_headers helpers — so the
wheel-CSP path no longer bypasses the audit trail. DRAFT-failure is fatal
(raise 500) so an order can never silently bypass the audit log. The raw
Schwab body is NOT a PlaceOrderRequest, so the audit row is built inline
(NOT via _build_audit_base). Returns the raw Schwab result on success
(AdminPage.tsx wheel shortcut depends on it).

## Path parameters

- `account_hash` string, required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/equity-rank/apis/equity-rank-api.md) · [All operations](https://skmtc.dev/equity-rank/apis/equity-rank-api/llms.txt) · [OpenAPI document](https://skmtc.dev/equity-rank/apis/equity-rank-api/revisions/c2f2463fee33?raw)