Orders
Create an order
Creates an order in DRAFT with the requested material.
Request examples
curl https://app.filmo.io/api/v1/orders \
--request POST \
--header "Authorization: Bearer $FILMO_API_KEY" \
--header "Idempotency-Key: $(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)" \
--header 'Content-Type: application/json' \
--data '{
"contactId": "cont_8f2a1c",
"startDate": "2026-09-01T08:00:00Z",
"endDate": "2026-09-05T20:00:00Z",
"lines": [
{
"itemId": "item_3b91de",
"quantity": 2
},
{
"itemId": "item_7c04af",
"quantity": 1,
"variantId": "var_11"
}
]
}'Generated from the schema
It is the validated equivalent of the project request inbox: it lets a web form, a CRM or an assistant request material for some dates.
It does NOT accept amounts of any kind (no prices, discounts, insurance or deposits): the order is born at zero and the team prices it from the application. Nor does it accept status, specific serialized units, accessories or notes.
Every referenced identifier (customer, items, project) is resolved against the account of the key BEFORE writing anything: a single one that does not belong to the account rejects the whole request with 400 and creates nothing.
Authorizations
Bearer API key with the scope below. orders:write
Headers
Unique identifier of the request, chosen by the client (a UUID works). Between 1 and 255 characters: an empty header is rejected with 400 validation_error, because the client would believe itself protected. Repeating the same key with the SAME body within 24 h returns the stored response without executing again, with the Idempotent-Replay: true header. With a DIFFERENT body it returns 422. It is the safe way to retry after a network timeout.
Limits: min length 1, max length 255
Example:"9f1c2f4e-3a5b-4f6d-8e7a-0b1c2d3e4f5a"
Optimistic locking: the ETag you read from the resource (or *). If the resource changed since, the write is rejected with 412 precondition_failed before doing anything; read it again and retry. Without the header the write always proceeds.
Example:"\"3sT3d9pBvZq4h2N0w8x1YkLmQ7c\""
Body
Body schema: OrderCreateBody
Identifier of the order customer. It must belong to the account of the API key.
Limits: min length 1, max length 100
Project the order is assigned to; omitted for a standalone order.
Limits: min length 1, max length 100
Rental start (ISO 8601 with offset).
Rental end (ISO 8601 with offset); it must be later than startDate.
Requested material (between 1 and 100 lines).
Limits: min 1 items, max 100 items
Show child attributesHide child attributes
Catalog item identifier. It must belong to the account of the API key.
Limits: min length 1, max length 100
Requested units of the item.
Limits: min 1, max 9999
Identifier of the specific variant; omitted for the base item.
Limits: min length 1, max length 100
Response
Successful response.
Response schema: OrderDetailDto
Envelope: OrderDetailResponse. meta. is present only when the operation is deprecated.
Headers: X-Request-Id · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · ETag · Idempotent-Replay
The order in full, as returned by the API.
Show child attributesHide child attributes
Unique order identifier.
Human-readable order number.
External reference of the order (for example, from the customer system); null if not recorded.
Raw order status as stored in the database (12 values): draft, reserved, prepared_partially, prepared, picked_up_partially, picked_up, returned_partially, returned, checked_in_partially, checked_in, archived or cancelled. archived is part of the stored set but an archived order is not visible to the API, so you will not observe it.
Available options: draft, reserved, prepared_partially, prepared, picked_up_partially, picked_up, returned_partially, returned, checked_in_partially, checked_in, archived, cancelled
Start of the rental period in ISO 8601 with offset.
End of the rental period in ISO 8601 with offset.
Number of billable rental days; null if not calculated.
Identifier of the project the order belongs to; null if not linked.
Name of the project the order belongs to; null if not linked.
Compact reference to the order contact; null if none.
Show child attributesHide child attributes
Unique contact identifier.
Contact name.
Number of items in the order.
Subtotal before discounts and taxes, as a decimal string "1234.50" (ROUND_HALF_UP).
Limits: pattern ^-?\d+\.\d{2}$
Total discounts as a decimal string "1234.50" (ROUND_HALF_UP); null if there is no discount.
Limits: pattern ^-?\d+\.\d{2}$
Insurance total as a decimal string "1234.50" (ROUND_HALF_UP).
Limits: pattern ^-?\d+\.\d{2}$
Deposit total as a decimal string "1234.50" (ROUND_HALF_UP).
Limits: pattern ^-?\d+\.\d{2}$
Tax total as a decimal string "1234.50" (ROUND_HALF_UP).
Limits: pattern ^-?\d+\.\d{2}$
Taxable base (net before taxes) as a decimal string "1234.50" (ROUND_HALF_UP).
Limits: pattern ^-?\d+\.\d{2}$
Total including taxes, as a decimal string "1234.50" (ROUND_HALF_UP).
Limits: pattern ^-?\d+\.\d{2}$
Custom field values by custom field identifier; the definitions are in /api.
Source the order was created from (for example web, mobile, admin); null if not recorded.
Creation date in ISO 8601 with offset.
Last update date in ISO 8601 with offset.
Billing address of the order; null if none.
Show child attributesHide child attributes
Descriptive label of the address; null if not recorded.
First address line; null if not recorded.
Second address line; null if not recorded.
City; null if not recorded.
Province or region; null if not recorded.
Postal code; null if not recorded.
Country; null if not recorded.
Shipping address of the order; null if none.
Show child attributesHide child attributes
Descriptive label of the address; null if not recorded.
First address line; null if not recorded.
Second address line; null if not recorded.
City; null if not recorded.
Province or region; null if not recorded.
Postal code; null if not recorded.
Country; null if not recorded.
Contact person linked to the order; null if none.
Show child attributesHide child attributes
Unique contact identifier.
Contact name.
Informational references to quotes generated from the order.
Show child attributesHide child attributes
Unique identifier of the referenced document.
Document number; null until it is numbered.
Document status at the time the reference was written; null if not recorded. Informational: it may be out of date.
Informational references to invoices generated from the order.
Show child attributesHide child attributes
Unique identifier of the referenced document.
Document number; null until it is numbered.
Document status at the time the reference was written; null if not recorded. Informational: it may be out of date.
Informational references to proformas generated from the order.
Show child attributesHide child attributes
Unique identifier of the referenced document.
Document number; null until it is numbered.
Document status at the time the reference was written; null if not recorded. Informational: it may be out of date.
Additional information about the response.
Show child attributesHide child attributes
Lifecycle warnings; present only when the operation is deprecated.
Show child attributesHide child attributes
Stable warning code.
Available options: deprecated
For people: what is deprecated, until when, and what to use.
Day (YYYY-MM-DD) the operation stops being served.
operationId of the operation to use instead, or null if there is none.
Where the deprecation is documented (the changelog).
Invalid request (validation_error): malformed query or body. errors[] lists every offending field with its stable code.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Authentication failed (unauthorized, api_key_invalid, api_key_revoked, api_key_expired, api_key_owner_inactive, api_key_owner_not_admin).
Headers: X-Request-Id · Content-Language · Idempotent-Replay
Not allowed (insufficient_scope: the API key does not have the required scope, named in requiredScope; forbidden: the owner of the key lacks the permission the operation requires). insufficient_scope is answered before the request counts against the rate limit, so it carries no RateLimit-* headers; forbidden does.
Headers: X-Request-Id · Content-Language · Idempotent-Replay
Resource not found (not_found): it does not exist or is outside the scope of the API key.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Conflict (conflict): the current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (If-Match) held the resource for more than five seconds. errors[0]. says which: in_progress and lock_timeout are solved by retrying; invalid_state is not, because the state of the resource forbids the operation.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Precondition failed (precondition_failed): the If-Match entity tag does not match the current representation. Read the resource again and retry.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Idempotency-Key reused (idempotency_key_reused): the same key was used before with a different body. Change the key.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Rate limit exceeded (rate_limited): retry after Retry-After seconds; RateLimit-* says which quota ran out.
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Retry-After · Idempotent-Replay
Internal error (internal_error).
Headers: X-Request-Id · Content-Language · RateLimit-Limit · RateLimit-Remaining · RateLimit-Reset · Idempotent-Replay
Errors
| Status | Codes | Meaning |
|---|---|---|
| 400 | validation_error | Malformed query or body. errors[] lists every offending field with its stable code. |
| 404 | not_found | It does not exist or is outside the scope of the API key. |
| 409 | conflict | The current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (If-Match) held the resource for more than five seconds. errors[0]. says which: in_progress and lock_timeout are solved by retrying; invalid_state is not, because the state of the resource forbids the operation. |
| 412 | precondition_failed | The If-Match entity tag does not match the current representation. Read the resource again and retry. |
| 422 | idempotency_key_reused | The same key was used before with a different body. Change the key. |
401, 403, 429, 500 can be returned by any operation. Errors
Deprecation
This operation is not deprecated. Deprecations are announced with a Deprecation header and a sunset date. Versioning policy
Related pages
Link to this section: Related pagesRentals
Order
The order, as returned by the API.
Was this page helpful?