# merchant_mismatch

> The resource belongs to another clinic

- Status: 403 Forbidden
- Returned by: /api/public
- Operations: [createOrder](https://developers.rivr.io/reference/api-public/createOrder.md), [getOrder](https://developers.rivr.io/reference/api-public/getOrder.md), [getOrderStatus](https://developers.rivr.io/reference/api-public/getOrderStatus.md), [getOrderReceipt](https://developers.rivr.io/reference/api-public/getOrderReceipt.md), [refundOrder](https://developers.rivr.io/reference/api-public/refundOrder.md), [cancelOrder](https://developers.rivr.io/reference/api-public/cancelOrder.md), [sendOrderToDevice](https://developers.rivr.io/reference/api-public/sendOrderToDevice.md), [getOrderSettlement](https://developers.rivr.io/reference/api-public/getOrderSettlement.md), [getSubscription](https://developers.rivr.io/reference/api-public/getSubscription.md)
- Retry (`retryWhen`): `after_fix`
- Did anything happen? (`outcome`): `none` (It did not happen)
- Access and organisation
- Page in the portal: https://developers.rivr.io/errors/merchant_mismatch
- Try it: `GET https://developers.rivr.io/errors/simulate/merchant_mismatch` answers with the code's exact wire form; `?succeedAfter=N&attempt=K` gives a 200 once `attempt` passes `N`

## What it means

The order, settlement or subscription belongs to another clinic than the token's, and nothing was created, changed or sent. Which clinic owns it is never said. `PUT /api/public/orders/{orderId}` (createOrder) answers this for an order id that another clinic holds, on any platform. The other operations answer it only when that clinic is on the same platform as the token's, and otherwise as if the resource didn't exist. `error` and `error_description` stay in the body as before, and the text names the resource.

## What your system does

Call with the token for the clinic that owns the resource. Don't create a new order under a new id to get around the answer.

## Is it worth retrying?

No, not without changing the call.

`retryWhen`: `after_fix`. Change the request first, as the code's page says: a value, the token, a header or a new key. Then send it.

## Did anything happen?

`outcome`: `none`. **It did not happen.** This call did not do what you asked for and changed nothing else that you can see or that concerns money. Where the code has an `outcomeNote`, it takes precedence.

## Example: /api/public

```http
HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "error": "merchant_mismatch",
  "error_description": "The order belongs to a different merchant than the API key. Use the API key issued for the merchant that owns the order.",
  "propertyName": null,
  "message": "The order belongs to a different merchant than the API key. Use the API key issued for the merchant that owns the order.",
  "errorCode": "merchant_mismatch",
  "code": "merchant_mismatch",
  "type": "https://developers.rivr.io/errors/merchant_mismatch"
}
```

The `title`, `detail`, `message` and `error_description` texts are exactly as the API writes them today.