Skip to main content
POST
Create an order.

Authorizations

Authorization
string
header
required

OAuth 2.0 client_credentials grant via Keycloak service account. Clients are provisioned per IntegrationOrganization in the nt24-idp realm.

Headers

Idempotency-Key
string
required

Client-generated unique key (UUID recommended) for this write operation. Identical key + identical body within 24h returns the cached response. Identical key + different body returns 422.

Required string length: 1 - 255

Path Parameters

sellerId
string<uuid>
required

UUID of the seller trade partner (must be in caller's authorized list).

Body

application/json
externalOrderId
string
required

Customer-provided unique identifier for the order.

buyerId
string<uuid>
required
purchaseDate
string<date>
required
vins
object[]
required
Minimum array length: 1
totalAmount
object
required
responsibleContact
object

Response

Existing order returned (idempotent replay), unchanged. notApplied names the fields of responsibleContact that the person this order already points at disagreed with, and is absent when there were none: the replayed body is matched on externalOrderId, and its responsibleContact on that person's email address alone, so a body naming a different person on that address reaches this response rather than the 409. Nothing is written — read responsibleContact on the response to see who the order points at.

uuid
string<uuid>
required
externalOrderId
string
required
buyerId
string<uuid>
required
status
enum<string>
required
Available options:
CREATED,
INVOICE_SUBMITTED,
PAYMENT_SUBMITTED,
READY_FOR_PICKUP,
TRANSPORT_IN_PROGRESS,
TRANSPORT_COMPLETED,
COMPLIANCE_VALID,
CANCELLED
vins
object[]
required
shipmentIds
string<uuid>[]
required

The order's live shipments, oldest first. One entry for an ordinary order; more once NT24 has split it. Each id addresses that half's payment under /partners/{sellerId}/orders/{uuid}/shipments/{shipmentId}/payment.

totalAmount
object
required
version
integer
required
createdAt
string<date-time>
required
updatedAt
string<date-time>
required
purchaseDate
string<date>
responsibleContact
object
notApplied
string[]

Fields of the request's responsibleContact that named something other than what the person already recorded under that email address says, and were therefore not written — responsibleContact.firstName, responsibleContact.lastName, responsibleContact.phone. responsibleContact.email is never listed: it is the key the two were matched on.

Present only on POST /orders and PATCH /orders/{uuid}, and only when there was something to report. Absent on every read, on a newly recorded person and on a call that agreed with the record. Present on a call that moved nothing, too — a body that named a different person on the address this order's contact already holds changes nothing AND disagrees with the record — so both the 200 of a replayed POST /orders and a PATCH that wrote nothing can carry it.

responsibleContact on the response carries the person the order actually points at. Nothing here is applied: a stored contact person is never overwritten through this API.

notApplied describes your request, not the order, so it is not part of the order's ETag and a read of the same order reproduces the tag the write returned.