---
title: "Send an order in (create or update)"
method: POST
path: "/orders"
tags: ["Orders"]
---

# Send an order in (create or update)

`POST /orders`

## Request

- Base URL: `https://sitesplaced.com/api/v1`
- URL: `https://sitesplaced.com/api/v1/orders`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Api-Key`

Secret key. Permission `orders:write`. Creates the order, or updates it if `external_id` was sent before. Safe to retry. The order source is decided by the key, never by the body: a WooCommerce connection key gives `woocommerce`, a Shopify connection gives `shopify`, any other secret key gives `api`.

## Request body

- OrderInput
  - `external_id` string, required: The order's id on the other system. Sending the same one again updates the order.
  - `number` string: The order number a shopper sees.
  - `status` string: Read according to `status_kind`.
  - `status_kind` 'woocommerce' | 'shopify' | 'sitesplaced': `woocommerce`: WooCommerce status slugs, with or without `wc-`. `shopify`: `open`, `partial`, `fulfilled` or `cancelled`. `sitesplaced`: the six order statuses, plus the aliases `delivered`, `fulfilled`, `processing`, `paid` and `canceled`. A connection key defaults to its platform; any other key defaults to `sitesplaced`.
  - `payment` object
    - `status` 'unpaid' | 'pending' | 'paid' | 'failed' | 'refunded' | 'partially_refunded': Send it. If it is missing the server guesses from the status.
    - `method` string
    - `method_title` string
    - `is_cod` boolean: True for cash on delivery. This is what turns on the COD risk flags.
    - `transaction_id` string
    - `refunded_amount` number
  - `currency` string
  - `totals` object, required
    - `total` number, required
    - `discount` number
    - `shipping` number
    - `cod_fee` number
    - `tax` number
  - `customer` object
    - `name` string
    - `email` string
    - `phone` string
    - `address_line1` string
    - `address_line2` string
    - `city` string
    - `state` string
    - `postcode` string
    - `country` string
  - `items` object[]: Up to 200 line items are kept.
    - `external_product_id` string
    - `name` string
    - `sku` string
    - `variant` string
    - `quantity` number
    - `unit_price` number
    - `image_url` string
  - `note` string
  - `tracking` object
    - `number` string, nullable
    - `courier` string, nullable
    - `url` string, nullable
  - `created_at` string, date-time: ISO 8601, in UTC.
  - `updated_at` string, date-time: Older than the copy SitesPlaced holds → ignored (`action: "unchanged"`).
  - `admin_url` string: The order's admin address on the other system.
  - `deleted` boolean: True archives the copy. It is never hard-deleted.
  - `test` boolean: True → skipped.
  - `delivered` boolean

## Response `200`

The order was updated, was unchanged, or was skipped.

- OrderUpsertResult
  - `order` Order, required
    - `id` string, uuid, required
    - `object` 'order', required
    - `order_number` string, nullable
    - `source` 'native' | 'woocommerce' | 'shopify' | 'api', required: `native` is the SitesPlaced checkout.
    - `external_id` string, nullable
    - `external_number` string, nullable
    - `external_status` string, nullable: The raw status on the other platform.
    - `external_url` string, nullable: The order's admin address on the other platform.
    - `status` 'pending' | 'confirmed' | 'shipped' | 'out_for_delivery' | 'completed' | 'cancelled', required: `completed` means delivered.
    - `payment` object, required
      - `method` string, required: For orders copied in from another platform this is only `cod` or `manual`; the real method is in `external_method`.
      - `status` 'unpaid' | 'pending' | 'paid' | 'failed' | 'refunded', required
      - `external_method` string, nullable
      - `external_method_title` string, nullable
    - `totals` object, required
      - `total` number, required
      - `discount` number, required
      - `shipping` number, required
      - `cod_fee` number, required
    - `currency` string, required
    - `customer` object, required
      - `name` string, required
      - `email` string, nullable
      - `phone` string, nullable
      - `address` string, nullable
      - `city` string, nullable
      - `state` string, nullable
      - `postcode` string, nullable
      - `country` string, nullable
    - `items` OrderItem[], required
      - `name` string, required
      - `variant` string, nullable
      - `quantity` number, required
      - `unit_price` number, required
      - `sku` string, nullable
      - `product_id` string, nullable: The SitesPlaced product id. Null on an order copied in from another platform.
      - `external_product_id` string, nullable
      - `image_url` string, nullable
    - `tracking` OrderTracking, required
      - `number` string, nullable
      - `courier` string, nullable
      - `url` string, nullable
      - `status_text` string, nullable
      - `page_url` string, uri, required: The public tracking page for this order.
    - `note` string, nullable
    - `risk` OrderRisk, nullable: Cash-on-delivery orders only.
      - `level` 'medium' | 'high'
      - `flags` object[]
        - `code` string, required
        - `label` string, required
    - `archived` boolean, required
    - `created_at` string, date-time, required: ISO 8601, in UTC.
    - `updated_at` string, date-time, required: ISO 8601, in UTC.
  - `action` 'created' | 'updated' | 'unchanged' | 'skipped', required
  - `reason` string: Set when `action` is `skipped`.

## Other responses

- `201`: The order was created.
- `400`: `invalid_request`. The request is malformed or a field has a bad value; `param` names the field.
- `401`: `unauthorized`. The key is missing, wrong or revoked.
- `403`: `forbidden`. The key may not do this: a secret key sent from a browser, a publishable key from a website not on its list, the wrong kind of key, or a missing permission.
- `413`: `payload_too_large`. Bodies can be up to 1 MB.
- `429`: `rate_limited`. Wait for `Retry-After` seconds.
- `500`: `internal_error`.
- `503`: `unavailable`.

---

[API](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api.md) · [All operations](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api/revisions/66fbfbbaad1a?raw)