Use this endpoint for orders pushed from your own OMS. It creates
the order on the first call and replaces it on later calls, and is the
recommended way to send us orders.
201on first create —data.newly_created: true,
data.applied: true, plusprotect_order_numberand
order_number.200withdata.applied: trueanddata.fields_changed_count
when the request body differs from the stored order.200withdata.applied: falseanddata.reason: "no_change"
when the request body matches the stored order.
The path identifies the order
The path parameter order_number identifies the order. If the
body also supplies order_number, it must match the path; otherwise
the request fails with 422 PATH_BODY_MISMATCH. You may omit
order_number from the body — the path value populates it.
Fields that cannot change after the first create
These fields are set on the first create and cannot be changed by a
later request: order_number, order_id, protect_order_number,
is_protected, amounts.protection_cost, order_date_created,
platform_domain, source_channel, api_version, and
order_lifecycle_status. On later requests, send the same values or
omit them — both are accepted. (platform is not in this list because
it is ignored on every request — see the field's description.)
Protection is frozen after the first push. is_protected and
amounts.protection_cost are validated as a PAIR on every request,
including re-pushes: send both with their stored values, or omit both.
A request stating one without the other is rejected with 422
(code: VALIDATION_ERROR) naming the missing field — this is the same
pairing rule that applies on the first create, and it is checked before
immutability is considered.
Sending a different is_protected or amounts.protection_cost is
rejected with 409 (code: PROTECTION_IMMUTABLE).
One case is worth calling out because the two rules overlap: sending
amounts.protection_cost: 0 on a protected order is rejected with
422, not 409. It fails the pairing rule first — a protected order
requires a fee above zero — so the validation error is what you
receive. It is still a rejection; only the code differs.
Omitting both fields leaves the stored values untouched. Protection is
reduced only by cancelling the order or part of it, through the
cancellation endpoint.
Server-injected fields
store_id, platform_domain, currency, source_channel, and
api_version are server-injected from the JWT-derived Store
record. Client values for these fields are silently dropped.
Line-item identity across updates
line_items is replaced wholesale on every applied change, so the body
MUST contain the full, current set of lines. Get Plus owns a read-only
line_id per line — the stable key returns are filed against (the
line_id used by POST /returns).
- On the first create you MAY supply your own
line_idon each line.
It's honoured only when every line carries a non-empty, order-unique
line_id(thenline_id_source: partner); otherwise Get Plus mints
li_<hex>ids for all lines (line_id_source: protectplus). - On every later update Get Plus carries the id forward: a line
that still matches an existing line (byproduct_id/sku) keeps its
line_id; only new lines get a new id. Aline_idsent on an update
is ignored — the id is fixed at create. Removing a line, or
swapping the product/sku on a line, drops/replaces that line's id —
so prefer quantity edits over re-keying a line you may still receive
returns for.
Guard: if an update would remove or re-key a line that already has
a return request, the request is rejected with 409
(code: LINE_HAS_ACTIVE_RETURN) and the offending lines are listed
under line_items. Adjust quantities instead, or leave the line in
place. (Lines without returns can be removed/changed freely.)
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||