---
title: "Platform operators: mark paid, mark registered, refund (a Stripe payment is refunded first), cancel, retry, or reveal a transfer code"
method: POST
path: "/operator/domain-orders/{orderId}/action"
tags: ["Operator"]
---

# Platform operators: mark paid, mark registered, refund (a Stripe payment is refunded first), cancel, retry, or reveal a transfer code

`POST /operator/domain-orders/{orderId}/action`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/operator/domain-orders/{orderId}/action`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `orderId` string, uuid, required

## Request body

- object
  - `action` 'mark_paid' | 'mark_registered' | 'refund' | 'cancel' | 'retry' | 'reveal_auth_code', required
  - `reason` string, required: why (shown in the operator audit log)
  - `expiresAt` string: mark_registered: when the registration expires (default: now + the years ordered)

## Response `200`

Done

- object
  - `id` string, uuid, required
  - `status` 'awaiting_payment' | 'paid' | 'registering' | 'registered' | 'failed' | 'refunded' | 'cancelled', required
  - `replay` boolean, required
  - `authCode` string, nullable, required: reveal_auth_code only: the transfer code (shown once, audited)
  - `refund` 'stripe' | 'manual' | 'none' | 'null', nullable, required: refund: how the money goes back (manual: pay it back yourself)

## Other responses

- `400`: Invalid request (code invalid_request); details.reason says what to fix
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden); operator writes may need a fresh session (details.reauthenticate)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict): details.reason taken, premium, owned, pending_order, price_changed, dns_changed (reload the records), dns_busy, dns_not_here, conflicting_records (details.records), …
- `429`: Too many searches or DNS requests (code rate_limited); see Retry-After
- `501`: Not set up on this server (code not_configured), e.g. no registrar key yet
- `503`: The registrar did not answer (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)