*REST API › Endpoint reference › Rentals › Orders*

# Cancel an order

> Cancels the order and releases what it had reserved: frees the stock, cancels the logistics tasks —preparation, shipping and pickup— and marks the linked documents.

> **Not reversible:** This operation cannot be undone.

`meta.tasksDeleted` says how many tasks were cancelled, because your schedule changes with this call. It is NOT reversible from the API: to have it back you have to duplicate it (`/unreserve` on a cancelled order responds 409 `conflict`, it does not return it to draft). An order already checked in (`checked_in`) cannot be cancelled (409 `conflict`, naming its status); one already cancelled is returned as it is. 404 if the order does not exist, belongs to another account or is archived. Returns the full order, the same projection as its GET.

`POST /api/v1/orders/{orderId}/cancel` — scope `orders:write`

Scope: `orders:write` · 120/min · Idempotency-Key · If-Match · Not reversible · MCP: `filmo_orders_cancel`

## Authorizations

Bearer API key with the scope below. `orders:write`

## Headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Idempotency-Key` | string | No | Unique identifier of the request, chosen by the client (a UUID works). Between 1 and 255 characters: an empty header is rejected with 400 `validation_error`, because the client would believe itself protected. Repeating the same key with the SAME body within 24 h returns the stored response without executing again, with the `Idempotent-Replay: true` header. With a DIFFERENT body it returns 422. It is the safe way to retry after a network timeout. |
| `If-Match` | string | No | Optimistic locking: the `ETag` you read from the resource (or `*`). If the resource changed since, the write is rejected with `412 precondition_failed` before doing anything; read it again and retry. Without the header the write always proceeds. |

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `orderId` | string | Yes | Order identifier. |

## Request examples

*Cancel an order*

**cURL**

```bash
curl https://app.filmo.io/api/v1/orders/orde_8f2a1c/cancel \
  --request POST \
  --header "Authorization: Bearer $FILMO_API_KEY" \
  --header "Idempotency-Key: $(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)"
```

**Node.js**

```javascript
fetch('https://app.filmo.io/api/v1/orders/orde_8f2a1c/cancel', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_FILMO_API_KEY',
    'Idempotency-Key': crypto.randomUUID()
  }
})
```

**Python**

```python
import uuid
import requests

requests.post(
    "https://app.filmo.io/api/v1/orders/orde_8f2a1c/cancel",
    headers={
      "Authorization": "Bearer YOUR_FILMO_API_KEY",
      "Idempotency-Key": str(uuid.uuid4())
    }
)
```

## Response

Response schema: `OrderDetailDto`

| Status | Description |
| --- | --- |
| 200 | Successful response. |
| 401 | Authentication failed (unauthorized, api_key_invalid, api_key_revoked, api_key_expired, api_key_owner_inactive, api_key_owner_not_admin). |
| 403 | Not allowed (insufficient_scope: the API key does not have the required scope, named in `requiredScope`; forbidden: the owner of the key lacks the permission the operation requires). `insufficient_scope` is answered before the request counts against the rate limit, so it carries no `RateLimit-*` headers; `forbidden` does. |
| 404 | Resource not found (not_found): it does not exist or is outside the scope of the API key. |
| 409 | Conflict (conflict): the current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (`If-Match`) held the resource for more than five seconds. `errors[0].code` says which: `in_progress` and `lock_timeout` are solved by retrying; `invalid_state` is not, because the state of the resource forbids the operation. |
| 412 | Precondition failed (precondition_failed): the `If-Match` entity tag does not match the current representation. Read the resource again and retry. |
| 422 | Idempotency-Key reused (idempotency_key_reused): the same key was used before with a different body. Change the key. |
| 429 | Rate limit exceeded (rate_limited): retry after `Retry-After` seconds; `RateLimit-*` says which quota ran out. |
| 500 | Internal error (internal_error). |

**200**

| Name | Type | Description |
| --- | --- | --- |
| `data` | object | The order in full, as returned by the API. |
| `data.id` | string | Unique order identifier. |
| `data.orderNumber` | string | Human-readable order number. |
| `data.externalReference` | string | External reference of the order (for example, from the customer system); null if not recorded. |
| `data.status` | string | Raw order status as stored in the database (12 values): draft, reserved, prepared_partially, prepared, picked_up_partially, picked_up, returned_partially, returned, checked_in_partially, checked_in, archived or cancelled. `archived` is part of the stored set but an archived order is not visible to the API, so you will not observe it. `draft`, `reserved`, `prepared_partially`, `prepared`, `picked_up_partially`, `picked_up`, `returned_partially`, `returned`, `checked_in_partially`, `checked_in`, `archived`, `cancelled` |
| `data.startDate` | string<date-time> | Start of the rental period in ISO 8601 with offset. |
| `data.endDate` | string<date-time> | End of the rental period in ISO 8601 with offset. |
| `data.rentalDays` | number | Number of billable rental days; null if not calculated. |
| `data.projectId` | string | Identifier of the project the order belongs to; null if not linked. |
| `data.projectName` | string | Name of the project the order belongs to; null if not linked. |
| `data.contact` | object | Compact reference to the order contact; null if none. |
| `data.contact.id` | string | Unique contact identifier. |
| `data.contact.name` | string | Contact name. |
| `data.itemsCount` | integer | Number of items in the order. |
| `data.subTotalPrice` | string | Subtotal before discounts and taxes, as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.discountTotal` | string | Total discounts as a decimal string "1234.50" (ROUND_HALF_UP); null if there is no discount. |
| `data.insuranceTotal` | string | Insurance total as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.depositTotal` | string | Deposit total as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.taxesPrice` | string | Tax total as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.netPrice` | string | Taxable base (net before taxes) as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.grossPrice` | string | Total including taxes, as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.tags` | object[] | Tags attached to the order, with their identifier and name. |
| `data.tags.id` | string | Unique identifier of the tag. |
| `data.tags.name` | string | Tag name. |
| `data.customFields` | object<string, any> | Custom field values by custom field identifier; the definitions are in `/api/v1/custom-fields`. |
| `data.source` | string | Source the order was created from (for example web, mobile, admin); null if not recorded. |
| `data.createdAt` | string<date-time> | Creation date in ISO 8601 with offset. |
| `data.updatedAt` | string<date-time> | Last update date in ISO 8601 with offset. |
| `data.billingAddress` | object | Billing address of the order; null if none. |
| `data.billingAddress.label` | string | Descriptive label of the address; null if not recorded. |
| `data.billingAddress.addressLine1` | string | First address line; null if not recorded. |
| `data.billingAddress.addressLine2` | string | Second address line; null if not recorded. |
| `data.billingAddress.city` | string | City; null if not recorded. |
| `data.billingAddress.province` | string | Province or region; null if not recorded. |
| `data.billingAddress.postcode` | string | Postal code; null if not recorded. |
| `data.billingAddress.country` | string | Country; null if not recorded. |
| `data.shippingAddress` | object | Shipping address of the order; null if none. |
| `data.shippingAddress.label` | string | Descriptive label of the address; null if not recorded. |
| `data.shippingAddress.addressLine1` | string | First address line; null if not recorded. |
| `data.shippingAddress.addressLine2` | string | Second address line; null if not recorded. |
| `data.shippingAddress.city` | string | City; null if not recorded. |
| `data.shippingAddress.province` | string | Province or region; null if not recorded. |
| `data.shippingAddress.postcode` | string | Postal code; null if not recorded. |
| `data.shippingAddress.country` | string | Country; null if not recorded. |
| `data.contactPerson` | object | Contact person linked to the order; null if none. |
| `data.contactPerson.id` | string | Unique contact identifier. |
| `data.contactPerson.name` | string | Contact name. |
| `data.quotes` | object[] | Informational references to quotes generated from the order. |
| `data.quotes.id` | string | Unique identifier of the referenced document. |
| `data.quotes.number` | string | Document number; null until it is numbered. |
| `data.quotes.status` | string | Document status at the time the reference was written; null if not recorded. Informational: it may be out of date. |
| `data.invoices` | object[] | Informational references to invoices generated from the order. |
| `data.invoices.id` | string | Unique identifier of the referenced document. |
| `data.invoices.number` | string | Document number; null until it is numbered. |
| `data.invoices.status` | string | Document status at the time the reference was written; null if not recorded. Informational: it may be out of date. |
| `data.proformas` | object[] | Informational references to proformas generated from the order. |
| `data.proformas.id` | string | Unique identifier of the referenced document. |
| `data.proformas.number` | string | Document number; null until it is numbered. |
| `data.proformas.status` | string | Document status at the time the reference was written; null if not recorded. Informational: it may be out of date. |
| `meta` | object |  |
| `meta.tasksDeleted` | integer | Logistics tasks that the cancellation cancelled when releasing the order. |
| `meta.warnings` | object[] | Lifecycle warnings; present only when the operation is deprecated. |
| `meta.warnings.code` | string | Stable warning code. `deprecated` |
| `meta.warnings.message` | string | For people: what is deprecated, until when, and what to use. |
| `meta.warnings.sunset` | string | Day (YYYY-MM-DD) the operation stops being served. |
| `meta.warnings.replacement` | string | `operationId` of the operation to use instead, or null if there is none. |
| `meta.warnings.link` | string | Where the deprecation is documented (the changelog). |

*Example response · 200*

```json
{
  "data": {
    "id": "order_9f3a2b",
    "orderNumber": "2026-0001",
    "externalReference": "2026-0001",
    "status": "draft",
    "startDate": "2026-09-01T08:00:00.000Z",
    "endDate": "2026-09-01T08:00:00.000Z",
    "rentalDays": 1,
    "projectId": "project_9f3a2b",
    "projectName": "Example project name",
    "contact": {
      "id": "contact_9f3a2b",
      "name": "Example contact"
    },
    "itemsCount": 1,
    "subTotalPrice": "120.00",
    "discountTotal": "120.00",
    "insuranceTotal": "120.00",
    "depositTotal": "120.00",
    "taxesPrice": "120.00",
    "netPrice": "120.00",
    "grossPrice": "120.00",
    "tags": [
      {
        "id": "tag_9f3a2b",
        "name": "Example tag"
      }
    ],
    "customFields": {
      "example": "example"
    },
    "source": "Example source",
    "createdAt": "2026-09-01T08:00:00.000Z",
    "updatedAt": "2026-09-01T08:00:00.000Z",
    "billingAddress": {
      "label": "Main",
      "addressLine1": "Calle de Ejemplo 12",
      "addressLine2": "Calle de Ejemplo 12",
      "city": "Madrid",
      "province": "Madrid",
      "postcode": "28001",
      "country": "ES"
    },
    "shippingAddress": {
      "label": "Main",
      "addressLine1": "Calle de Ejemplo 12",
      "addressLine2": "Calle de Ejemplo 12",
      "city": "Madrid",
      "province": "Madrid",
      "postcode": "28001",
      "country": "ES"
    },
    "contactPerson": {
      "id": "contact_person_9f3a2b",
      "name": "Example contact person"
    },
    "quotes": [
      {
        "id": "quote_9f3a2b",
        "number": "2026-0001",
        "status": "Example status"
      }
    ],
    "invoices": [
      {
        "id": "invoice_9f3a2b",
        "number": "2026-0001",
        "status": "Example status"
      }
    ],
    "proformas": [
      {
        "id": "proforma_9f3a2b",
        "number": "2026-0001",
        "status": "Example status"
      }
    ]
  },
  "meta": {
    "tasksDeleted": 1
  }
}
```

## Errors

| Status | Codes | Meaning |
| --- | --- | --- |
| 404 | `not_found` | It does not exist or is outside the scope of the API key. |
| 409 | `conflict` | The current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (`If-Match`) held the resource for more than five seconds. `errors[0].code` says which: `in_progress` and `lock_timeout` are solved by retrying; `invalid_state` is not, because the state of the resource forbids the operation. |
| 412 | `precondition_failed` | The `If-Match` entity tag does not match the current representation. Read the resource again and retry. |
| 422 | `idempotency_key_reused` | The same key was used before with a different body. Change the key. |

## Deprecation

This operation is not deprecated. Deprecations are announced with a Deprecation header and a sunset date.

---

Canonical URL: https://docs.filmo.io/rest-api/endpoint-reference/orders/cancel-an-order  
Last updated: 2026-10-25