# PUT /api/public/orders/{orderId}

> Create Order

**Retrying safely.** Creating an order is idempotent through the order id that your system chooses: the id is
in the path, and every request with the same id creates at most one order. A retry of a request whose response was
lost therefore returns the same order instead of creating a second one, so this endpoint does not use an
`Idempotency-Key` header (it is ignored here). When two requests with the same id arrive at the same time,
the one that loses gets **409**, or in rare cases **500**; in both cases wait a moment and retry it with the
same id. Two requests for different orders can collide the same way when they arrive at the same time for a patient
who is new to Rivr. The **409** carries `Retry-After`. Note that a new request for an order that has been
cancelled or refunded opens it again as unpaid, so give every new payment a new id.

- Surface: `/api/public` · operationId `createOrder` · Group: Order
- Authorisation: Token with scope `public:orders:write`
- Organisation key: needs the capabilities `orders:manage` + `customers:read` on the clinic, all together
- The spec: https://developers.rivr.io/openapi/api-public.json
- The spec's introduction: https://developers.rivr.io/reference/api-public.md
- Page in the portal: https://developers.rivr.io/reference/api-public/createOrder

The examples target the sandbox (`https://api.test.rivr.io`) and need test credentials.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orderId` | path | string (uuid) | yes | The unique identifier (UUID) of the order. It must be unique for each order and is chosen by the calling system. |

## Request body (`application/json`, optional)

The order to create, as a JSON body.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string (uuid) | – | The id of the order (UUID). It is the same id as in the `orderId` path parameter. |
| `merchantId` | string (uuid) | – | The unique identifier (UUID) of the Merchant (available in the Merchant portal) |
| `reference` | string | – | A unique payment reference. This should be your internally unique payment reference (ie an order number or other reference). (nullable) |
| `email` | string | – | The email address of the payer, the person that will pay for the order. (nullable) |
| `phone` | string | – | The phone number of the payer, the person that will pay for the order. (nullable) |
| `checkoutHints` | DomainCheckoutHint[] | – | Optional instructions for this order, as a list of hints. Each hint has a `type` and a `value`; the description of a hint says what each type expects. |
| `checkoutHints[].type` | DomainCheckoutHintType | – | The checkout hint type as a string. The name is matched case-insensitively, so `device` and `Device` are the same. Earlier versions of this specification described the type as a number, and the number is still accepted, but new integrations should send the name. The numbers are: `device` = 1, `redirect` = 2, `disableNotifications` = 4, `advancePayment` = 8, `autoCancelInSeconds` = 16, `chargeStoredCard` = 32, `disableDescriptionEncryption` = 64, `cancelRedirect` = 128. What `value` must hold for each type is described on the `value` field of the hint. (Values: device, redirect, disableNotifications, advancePayment, autoCancelInSeconds, chargeStoredCard, disableDescriptionEncryption, cancelRedirect) |
| `checkoutHints[].value` | string | – | The value of the hint. What it must hold depends on `type`. Types are written here as they are sent in a request. A value that does not follow its rule has no effect, as if the hint was not sent, except where the rule says that the order is rejected. - `device`: the `id` (a UUID) of one of the merchant's devices, as listed by `GET /api/public/devices`. When the order is created, Rivr sends it to that device if the device is online, so that the patient can pay on it. A value that is not a UUID is ignored, and so is the id of a device that is not one of the merchant's (an unknown id, or a device of another merchant): the order is then never sent to that device, and the merchant's own devices are used as if the hint was not sent. - `redirect`: an absolute `https` URL. When the order has been paid, the Rivr checkout sends the patient's browser to this URL with `rivr_status=completed` added to the query. If the order also has a `cancelRedirect` hint, a payment that is still pending (for example when the patient chose an invoice) sends the patient here with `rivr_status=pending`. The parameter is only a hint about what to show; learn the outcome from the order callback. Use `https`. A plain `http` URL is let through when the order is created, but the checkout redirects only to `https` URLs and to `http` URLs on localhost (`localhost`, `127.0.0.1` or `[::1]`). A value that is missing, relative or of another scheme is rejected with HTTP 422 and the code `checkout_hint_redirect_invalid`. - `disableNotifications`: `true` (read as a boolean, so letter case does not matter). Any other value, or none, leaves notifications on. With `true`, Rivr does not send the payment link by SMS or by email, the reminder SMS, the payment confirmation email or the SMS about a refund. Two messages are not affected: the receipt SMS after a payment on a payment terminal (sent when Rivr has no email address to send the receipt to, or when the patient already got an SMS for the order), and the cancellation SMS to a patient who already got an SMS for the order. - `advancePayment`: the value is not read, so any value or none has the same effect. Rivr marks the order as an advance payment in its settlement data (the order's row in the settlement gets the metadata key `AdvancePayment` with the value `true`) and leaves it out of the Nets payment file of the settlement. - `autoCancelInSeconds`: a positive whole number of seconds, for example `1800`. When that time has passed since the order was created, or since it was restarted, Rivr cancels the order if it is still unpaid (status `Created`) and can still be cancelled. Otherwise it is left as it is. A value that is not a whole number is ignored. - `chargeStoredCard`: leave the value out, or send `true`; only the value `false` switches the hint off. When the order is created, the Rivr checkout tries to charge a card that the patient has saved at this clinic. A card saved at another clinic is never used. The payment link is sent as usual unless `disableNotifications` is also set; if there is no usable saved card, or the charge cannot be made, the patient pays through that link. Only the Rivr checkout acts on this hint. - `disableDescriptionEncryption`: `true` (read as a boolean, so letter case does not matter). Any other value, or none, leaves encryption as it is configured. With `true`, Rivr stores the order line descriptions of this order, and of an invoice that Rivr later creates from the order, in plain text. Without it, a merchant that Rivr has set up to encrypt descriptions gets them encrypted, with a generic label shown in their place. It makes no difference for a merchant that does not encrypt descriptions. - `cancelRedirect`: an absolute `https` URL. The patient is sent here when the payment did not happen: the patient cancelled in the checkout, the order was already cancelled when the patient opened the payment link, or the checkout session expired. `rivr_status=cancelled` or `rivr_status=expired` is added to the query, as a hint only. A value that is missing, is not an absolute `https` URL, or is an `http` URL other than one on localhost outside production (`localhost`, `127.0.0.1` or `[::1]`) is rejected with HTTP 422 and the code `checkout_hint_cancel_redirect_invalid`. (nullable) |
| `callbackUrl` | string | – | The URL that Rivr notifies when the order changes status, with an HTTP POST. The URL has to use HTTPS. See Callbacks in the integration guide for the body and the retries. (nullable) |
| `metadata` | map<string, string> | – | A dictionary of key-value pairs that can be used to store additional information about the order. |
| `personalNumber` | string | – | The personal number of the payer, the person that will pay for the order. (nullable) |
| `currencyCode` | string | – | The ISO 4217 currency code of the order, for example `SEK`. When it is left out, the merchant's own currency is used. (nullable) |
| `orderLines` | OrderLine[] | – | Order lines that should be included in the order. |
| `orderLines[].description` | string | – | The name of the product or service |
| `orderLines[].quantity` | number (double) | – | The quantity of the product or service |
| `orderLines[].unitPriceExclVat` | number (double) | – | The price of one unit of the product or service, excluding VAT |
| `orderLines[].vatPercentage` | integer (int32) | – | The VAT rate of the product or service (0, 6, 12 or 25) |
| `orderLines[].discountExclVat` | number (double) | – | Optional discount amount excluding VAT applied to this line. The discount is subtracted from the line total (`unitPriceExclVat * quantity`) before VAT is calculated. |

**Example**

```json
{
  "id": "da4316b7-e2f4-42b0-b0a8-1ed6c24f9738",
  "merchantId": "c3073b9d-edd0-49f2-a28d-b7ded8ff9a8b",
  "reference": "order-1234",
  "email": "kontakt@example.com",
  "phone": "+46701740605",
  "checkoutHints": [],
  "callbackUrl": "https://www.example.com/my/callback",
  "metadata": {
    "bookingId": "48213"
  },
  "personalNumber": "195001182046",
  "currencyCode": "SEK",
  "orderLines": [
    {
      "description": "Product 1",
      "quantity": 1,
      "unitPriceExclVat": 2500,
      "vatPercentage": 25,
      "discountExclVat": 0
    }
  ]
}
```

## Responses

### 201

The order was created, or the existing order with this id was updated.

`application/json`

**Response fields**

| Field | Type | Description |
| --- | --- | --- |
| `id` | string (uuid) |  |
| `createdDate` | string (date-time) |  |
| `modifiedDate` | string (date-time) |  |
| `version` | integer (int32) | (nullable) |
| `merchantId` | string (uuid) |  |
| `shortId` | string | (nullable) |
| `checkoutUrl` | string | The patient-facing checkout URL for this order. It is the same entry link Rivr sends by text message, so it resolves to whichever checkout the merchant is on, and to My Pages once the order is paid. Send the patient here to pay in the browser, for example while booking. Null when the order has no short id yet, which is the case only for orders created before short ids existed. Do not build the URL yourself, and do not cache it across environments: the host differs per environment. (nullable) |
| `merchantName` | string | (nullable) |
| `currencyCode` | string |  |
| `customer` | PublicApiCommonCustomer |  |
| `customer.id` | string (uuid) |  |
| `customer.createdDate` | string (date-time) |  |
| `customer.modifiedDate` | string (date-time) |  |
| `customer.version` | integer (int32) | (nullable) |
| `customer.personalNumber` | string | (nullable) |
| `customer.firstName` | string | (nullable) |
| `customer.lastName` | string | (nullable) |
| `customer.name` | string | Display name: `firstName` and `lastName` joined with a space. Empty parts are skipped, so a customer with a single name does not get a leading or trailing space (for example `"Acme "`). `null` when both are empty. (nullable) |
| `customer.email` | string | (nullable) |
| `customer.phone` | string | (nullable) |
| `customer.address` | PublicApiAddress |  |
| `customer.address.street` | string | (nullable) |
| `customer.address.street2` | string | (nullable) |
| `customer.address.postalCode` | string | (nullable) |
| `customer.address.city` | string | (nullable) |
| `customer.address.country` | string | (nullable) |
| `orderLines` | OrderLinePublic[] |  |
| `orderLines[].description` | string | The name of the product or service |
| `orderLines[].quantity` | number (double) | The quantity of the product or service |
| `orderLines[].unitPriceExclVat` | number (double) | The price of one unit of the product or service, excluding VAT |
| `orderLines[].vatPercentage` | integer (int32) | The VAT rate of the product or service (0, 6, 12 or 25) |
| `orderLines[].discountExclVat` | number (double) | Optional discount amount excluding VAT applied to this line. The discount is subtracted from the line total (`unitPriceExclVat * quantity`) before VAT is calculated. |
| `orderLines[].isEncrypted` | boolean |  |
| `orderLines[].unitPriceInclVat` | number (double) |  |
| `orderLines[].amountInclVat` | number (double) |  |
| `orderLines[].amountExclVat` | number (double) |  |
| `amount` | number (double) |  |
| `amountExclVat` | number (double) |  |
| `vatAmount` | number (double) |  |
| `reference` | string | (nullable) |
| `ocr` | string | (nullable) |
| `paymentMethod` | PaymentMethodPublic | (Values: 0 = NotPaid, 1 = Card, 2 = Swish, 3 = Invoice, 4 = Instalment, 5 = Vipps, 6 = Trustly, 7 = Direct, 8 = Unknown) |
| `status` | OrderStatus | (Values: 0 = None, 1 = Created, 2 = Pending, 4 = Completed, 8 = Refunded, 32 = Cancelled) |
| `success` | boolean |  |
| `callbackUrl` | string | (nullable) |
| `checkoutHints` | PublicApiCheckoutHint[] | The hints stored on the order. Each hint has a `type` and a `value`; the description of a hint says what each type means. |
| `checkoutHints[].type` | PublicApiCheckoutHintType | The checkout hint type as a string, written in PascalCase (for example `Device`). What `value` must hold for each type is described on the `value` field of the hint. (Values: Device, Redirect, DisableNotifications, AdvancePayment, AutoCancelInSeconds, ChargeStoredCard, DisableDescriptionEncryption, CancelRedirect) |
| `checkoutHints[].value` | string | The value of the hint. What it must hold depends on `type`. Types are written here as they are sent in a request. A value that does not follow its rule has no effect, as if the hint was not sent, except where the rule says that the order is rejected. - `device`: the `id` (a UUID) of one of the merchant's devices, as listed by `GET /api/public/devices`. When the order is created, Rivr sends it to that device if the device is online, so that the patient can pay on it. A value that is not a UUID is ignored, and so is the id of a device that is not one of the merchant's (an unknown id, or a device of another merchant): the order is then never sent to that device, and the merchant's own devices are used as if the hint was not sent. - `redirect`: an absolute `https` URL. When the order has been paid, the Rivr checkout sends the patient's browser to this URL with `rivr_status=completed` added to the query. If the order also has a `cancelRedirect` hint, a payment that is still pending (for example when the patient chose an invoice) sends the patient here with `rivr_status=pending`. The parameter is only a hint about what to show; learn the outcome from the order callback. Use `https`. A plain `http` URL is let through when the order is created, but the checkout redirects only to `https` URLs and to `http` URLs on localhost (`localhost`, `127.0.0.1` or `[::1]`). A value that is missing, relative or of another scheme is rejected with HTTP 422 and the code `checkout_hint_redirect_invalid`. - `disableNotifications`: `true` (read as a boolean, so letter case does not matter). Any other value, or none, leaves notifications on. With `true`, Rivr does not send the payment link by SMS or by email, the reminder SMS, the payment confirmation email or the SMS about a refund. Two messages are not affected: the receipt SMS after a payment on a payment terminal (sent when Rivr has no email address to send the receipt to, or when the patient already got an SMS for the order), and the cancellation SMS to a patient who already got an SMS for the order. - `advancePayment`: the value is not read, so any value or none has the same effect. Rivr marks the order as an advance payment in its settlement data (the order's row in the settlement gets the metadata key `AdvancePayment` with the value `true`) and leaves it out of the Nets payment file of the settlement. - `autoCancelInSeconds`: a positive whole number of seconds, for example `1800`. When that time has passed since the order was created, or since it was restarted, Rivr cancels the order if it is still unpaid (status `Created`) and can still be cancelled. Otherwise it is left as it is. A value that is not a whole number is ignored. - `chargeStoredCard`: leave the value out, or send `true`; only the value `false` switches the hint off. When the order is created, the Rivr checkout tries to charge a card that the patient has saved at this clinic. A card saved at another clinic is never used. The payment link is sent as usual unless `disableNotifications` is also set; if there is no usable saved card, or the charge cannot be made, the patient pays through that link. Only the Rivr checkout acts on this hint. - `disableDescriptionEncryption`: `true` (read as a boolean, so letter case does not matter). Any other value, or none, leaves encryption as it is configured. With `true`, Rivr stores the order line descriptions of this order, and of an invoice that Rivr later creates from the order, in plain text. Without it, a merchant that Rivr has set up to encrypt descriptions gets them encrypted, with a generic label shown in their place. It makes no difference for a merchant that does not encrypt descriptions. - `cancelRedirect`: an absolute `https` URL. The patient is sent here when the payment did not happen: the patient cancelled in the checkout, the order was already cancelled when the patient opened the payment link, or the checkout session expired. `rivr_status=cancelled` or `rivr_status=expired` is added to the query, as a hint only. A value that is missing, is not an absolute `https` URL, or is an `http` URL other than one on localhost outside production (`localhost`, `127.0.0.1` or `[::1]`) is rejected with HTTP 422 and the code `checkout_hint_cancel_redirect_invalid`. (nullable) |
| `metadata` | map<string, string> |  |
| `receipts` | OrderReceiptInfo[] |  |
| `receipts[].id` | string (uuid) |  |
| `receipts[].date` | string (date-time) |  |
| `receipts[].paymentMethod` | PaymentMethodPublic | (Values: 0 = NotPaid, 1 = Card, 2 = Swish, 3 = Invoice, 4 = Instalment, 5 = Vipps, 6 = Trustly, 7 = Direct, 8 = Unknown) |
| `receipts[].receiptFormat` | ReceiptFormat | (Values: 0 = None, 1 = Json, 2 = Pdf) |

**Example**

```json
{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "createdDate": "2026-10-18T09:00:00Z",
  "modifiedDate": "2026-10-18T09:00:00Z",
  "version": 0,
  "merchantId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "shortId": "string",
  "checkoutUrl": "https://rivr.io/o/a1b2c3",
  "merchantName": "string",
  "currencyCode": "string",
  "customer": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "createdDate": "2026-10-18T09:00:00Z",
    "modifiedDate": "2026-10-18T09:00:00Z",
    "version": 0,
    "personalNumber": "string",
    "firstName": "string",
    "lastName": "string",
    "name": "string",
    "email": "string",
    "phone": "string",
    "address": {
      "street": "string",
      "street2": "string",
      "postalCode": "string",
      "city": "string",
      "country": "string"
    }
  },
  "orderLines": [
    {
      "description": "Product 1",
      "quantity": 1,
      "unitPriceExclVat": 2500,
      "vatPercentage": 25,
      "discountExclVat": 0,
      "isEncrypted": false,
      "unitPriceInclVat": 0,
      "amountInclVat": 0,
      "amountExclVat": 0
    }
  ],
  "amount": 0,
  "amountExclVat": 0,
  "vatAmount": 0,
  "reference": "string",
  "ocr": "string",
  "paymentMethod": 1,
  "status": 1,
  "success": false,
  "callbackUrl": "string",
  "checkoutHints": [
    {
      "type": "Device",
      "value": "string"
    }
  ],
  "metadata": {
    "key": "string"
  },
  "receipts": [
    {
      "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "date": "2026-10-18T09:00:00Z",
      "paymentMethod": 1,
      "receiptFormat": 1
    }
  ]
}
```

### 400

The `merchantId` in the token does not match the `merchantId` in the body, or the body has no `merchantId`: an
error object with `propertyName` and `message` and the `code` `merchant_id_mismatch`. A rule in Rivr that refuses the
order, for example a blocked customer or a person who cannot be identified, gives `request_rejected` with the reason
in `message`, and a credit check that is not approved gives `credit_check_failed`. An unknown
`checkoutHints[].type` or an order line without `description` gives the validation problem described next. A request that cannot be read is rejected before the operation runs, with a validation problem instead: malformed JSON, a value of the wrong type, an empty body, a missing or `null` required field or a path parameter `orderId` that is not a UUID. It carries the `code` `request_invalid`, `type`, `message`, `title`, `status`, `errors` (the messages per field) and `traceId`.

Error codes: [request_invalid](https://developers.rivr.io/errors/request_invalid.md), [request_rejected](https://developers.rivr.io/errors/request_rejected.md), [merchant_id_mismatch](https://developers.rivr.io/errors/merchant_id_mismatch.md), [credit_check_failed](https://developers.rivr.io/errors/credit_check_failed.md)

`application/json`

```json
{
  "propertyName": "MerchantId",
  "message": "The merchantId in the token does not match the merchantId in the payload",
  "errorCode": "merchant_id_mismatch",
  "code": "merchant_id_mismatch",
  "type": "https://developers.rivr.io/errors/merchant_id_mismatch"
}
```

### 401

The token is missing (`token_missing`), not valid (`token_invalid`), expired (`token_expired`) or could not be
checked (`authentication_unavailable`), or it is not issued for a merchant (`merchant_token_required`).

Error codes: [token_missing](https://developers.rivr.io/errors/token_missing.md), [token_invalid](https://developers.rivr.io/errors/token_invalid.md), [token_expired](https://developers.rivr.io/errors/token_expired.md), [authentication_unavailable](https://developers.rivr.io/errors/authentication_unavailable.md), [merchant_token_required](https://developers.rivr.io/errors/merchant_token_required.md)

`application/json`

```json
{
  "title": "Unauthorized",
  "status": 401,
  "detail": "Invalid Authorization Header",
  "propertyName": null,
  "message": "The request has no valid Authorization header. Send the token in the Authorization header, after Bearer.",
  "errorCode": "token_missing",
  "code": "token_missing",
  "type": "https://developers.rivr.io/errors/token_missing"
}
```

### 403

The token lacks the scope (`invalid_scope`), is a rivr-auth token that is not a clinic token
(`clinic_token_required`), or the order id belongs to another merchant (`merchant_mismatch`). The body also carries
`error` and `error_description`, as before.

Error codes: [invalid_scope](https://developers.rivr.io/errors/invalid_scope.md), [clinic_token_required](https://developers.rivr.io/errors/clinic_token_required.md), [merchant_mismatch](https://developers.rivr.io/errors/merchant_mismatch.md)

`application/json`

```json
{
  "error": "invalid_scope",
  "error_description": "The scope(s) 'public:orders:write' is required.",
  "propertyName": null,
  "message": "The scope(s) 'public:orders:write' is required.",
  "errorCode": "invalid_scope",
  "code": "invalid_scope",
  "type": "https://developers.rivr.io/errors/invalid_scope"
}
```

### 404

The order id belongs to an order created with another organisation's key: `order_not_found`.

Error codes: [order_not_found](https://developers.rivr.io/errors/order_not_found.md)

`application/json`

```json
{
  "propertyName": "orderId",
  "message": "The order was not found",
  "errorCode": "order_not_found",
  "code": "order_not_found",
  "type": "https://developers.rivr.io/errors/order_not_found"
}
```

### 409

Another request wrote the same order, or created the same new patient, at the same time: `order_modified_concurrently`,
with `Retry-After`. Retry with the same order id.

Error codes: [order_modified_concurrently](https://developers.rivr.io/errors/order_modified_concurrently.md)

`application/json`

```json
{
  "propertyName": "orderId",
  "message": "The order was modified concurrently by another request. Retry the request.",
  "errorCode": "order_modified_concurrently",
  "code": "order_modified_concurrently",
  "type": "https://developers.rivr.io/errors/order_modified_concurrently"
}
```

### 422

The order breaks a rule. The body carries the first failing rule in `errorCode` and `code`:
`personal_number_not_identifiable`, `personal_number_required`, `currency_code_invalid`, `currency_not_supported`,
`amount_zero_or_negative`, `vat_percentage_negative`, `discount_negative`, `discount_exceeds_line_total`,
`email_required`, `phone_required`, `reference_required`, `checkout_hint_redirect_invalid`,
`checkout_hint_cancel_redirect_invalid` or `callback_url_invalid`. Fix the request and send it again with the same order id.
`callback_url_invalid` (`propertyName` `CallbackUrl`) means that `callbackUrl` is not an address Rivr delivers callbacks to:
it must be an absolute https URL of at most 2048 characters, without user info or a fragment, and its host (in IDNA form)
must not be `localhost`, a name under `.localhost` or an IP address in a loopback, private, carrier-grade NAT,
link-local, multicast or unique-local range.
Rivr switches the rule on per environment, starting with the sandbox; where it is not switched on, `callbackUrl` is accepted as before.
A Rivr sandbox merchant accepts only test identities, and checks that rule first: a personal number that is not one
gives `personal_number_not_test_identity` before the customer is looked up, and nothing is created. Use one of
Skatteverket's published test personal numbers, one of Avarda's documented test persons or a synthetic Norwegian
identity number (a reserved test person, month + 65, or a Test-Norge or Tenor number, month + 80).

Error codes: [currency_not_supported](https://developers.rivr.io/errors/currency_not_supported.md), [personal_number_not_identifiable](https://developers.rivr.io/errors/personal_number_not_identifiable.md), [personal_number_required](https://developers.rivr.io/errors/personal_number_required.md), [personal_number_not_test_identity](https://developers.rivr.io/errors/personal_number_not_test_identity.md), [currency_code_invalid](https://developers.rivr.io/errors/currency_code_invalid.md), [amount_zero_or_negative](https://developers.rivr.io/errors/amount_zero_or_negative.md), [vat_percentage_negative](https://developers.rivr.io/errors/vat_percentage_negative.md), [discount_negative](https://developers.rivr.io/errors/discount_negative.md), [discount_exceeds_line_total](https://developers.rivr.io/errors/discount_exceeds_line_total.md), [email_required](https://developers.rivr.io/errors/email_required.md), [phone_required](https://developers.rivr.io/errors/phone_required.md), [reference_required](https://developers.rivr.io/errors/reference_required.md), [checkout_hint_redirect_invalid](https://developers.rivr.io/errors/checkout_hint_redirect_invalid.md), [checkout_hint_cancel_redirect_invalid](https://developers.rivr.io/errors/checkout_hint_cancel_redirect_invalid.md), [callback_url_invalid](https://developers.rivr.io/errors/callback_url_invalid.md)

`application/json`

```json
{
  "propertyName": "CurrencyCode",
  "message": "CurrencyCode 'EUR' is not supported by the merchant '3f6c2a1e-8b4d-4c7a-9e21-5d0b7f9a1c3e'. Supported currency is SEK.",
  "errorCode": "currency_not_supported",
  "code": "currency_not_supported",
  "type": "https://developers.rivr.io/errors/currency_not_supported"
}
```

### 500

Something unexpected failed: `internal_error`. Check the order with `GET` before you retry.

Error codes: [internal_error](https://developers.rivr.io/errors/internal_error.md)

`application/json`

```json
{
  "propertyName": null,
  "message": "Something unexpected failed at Rivr, and whether the request was carried out is not known. Check the order or what the request was about before you retry.",
  "errorCode": "internal_error",
  "code": "internal_error",
  "type": "https://developers.rivr.io/errors/internal_error"
}
```

## Example request

```bash
curl -X PUT https://api.test.rivr.io/api/public/orders/da4316b7-e2f4-42b0-b0a8-1ed6c24f9738 \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "id": "da4316b7-e2f4-42b0-b0a8-1ed6c24f9738",
  "merchantId": "c3073b9d-edd0-49f2-a28d-b7ded8ff9a8b",
  "reference": "order-1234",
  "email": "kontakt@example.com",
  "phone": "+46701740605",
  "checkoutHints": [],
  "callbackUrl": "https://www.example.com/my/callback",
  "metadata": {
    "bookingId": "48213"
  },
  "personalNumber": "195001182046",
  "currencyCode": "SEK",
  "orderLines": [
    {
      "description": "Product 1",
      "quantity": 1,
      "unitPriceExclVat": 2500,
      "vatPercentage": 25,
      "discountExclVat": 0
    }
  ]
}'
```