Update Order
PUT/api/channel/orders/:id
Updates a sales order for the authenticated channel.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Authentication: Requires channel integration token.
Returns 403 if the order does not belong to the authenticated channel.
Request body fields are optional — only the keys you send are applied.
- sales_order_number (string): Must be unique among the orders on the same sales channel. Sending a number another order already uses on that channel returns 422; re-sending the order's own current number is always accepted.
Picking a saved address by id: send shipping_address: {"id": 812} (or billing_address) with no other address fields to attach one of the customer's saved addresses as-is. The id must be one of the address-book addresses of the customer the order will have after this update (the customer_id in the same request, or the order's current customer). It is refused with 422 on shipping_address.id / billing_address.id when the address does not exist, when it belongs to someone else, or when the order has no customer. An address object that carries address fields (with or without an id) is saved by value as before.
Fields SKU.io owns are ignored on this endpoint (the rest of the update still applies): sales_channel_id (an order cannot be moved to another channel), fulfillment_status, fulfilled_at, canceled_at, the internal bypass_fulfillment_recompute flag, and bare shipping_address_id / billing_address_id. Name addresses through shipping_address / billing_address instead. The success message names the order number.
Sending a line id that does not exist on this order returns 400 with a message naming the line, instead of a server error.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Bad Request
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Unprocessable Entity
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.