*REST API › Endpoint reference › Rentals › Orders*

# Update the header of an order

> Changes the header of an order: customer, project and rental dates (send only the fields to change; the rest stay as they were).

Changing `startDate` or `endDate` moves the WHOLE order: every line that inherits the order period moves with it (sections, type groups and lines already checked in keep theirs), together with its stock reservations and its delivery and return tasks; prices are not recalculated. If the stock does not fit the new period, or the order is cancelled or returned, it responds 409 `conflict` and nothing is written; sending the dates it already has changes nothing. It does NOT add, remove or edit lines: that goes through the editor. It does not accept amounts or status either, just like creation. The customer and the project are checked against the account of the API key before writing anything. Returns the full order, the same projection as its GET.

`PATCH /api/v1/orders/{orderId}` — scope `orders:write`

Scope: `orders:write` · 120/min · Idempotency-Key · If-Match · MCP: `filmo_orders_update`

## Authorizations

Bearer API key with the scope below. `orders:write`

## Headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Idempotency-Key` | string | No | Unique identifier of the request, chosen by the client (a UUID works). Between 1 and 255 characters: an empty header is rejected with 400 `validation_error`, because the client would believe itself protected. Repeating the same key with the SAME body within 24 h returns the stored response without executing again, with the `Idempotent-Replay: true` header. With a DIFFERENT body it returns 422. It is the safe way to retry after a network timeout. |
| `If-Match` | string | No | Optimistic locking: the `ETag` you read from the resource (or `*`). If the resource changed since, the write is rejected with `412 precondition_failed` before doing anything; read it again and retry. Without the header the write always proceeds. |

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `orderId` | string | Yes | Order identifier. |

## Body

Body schema: `OrderUpdateBody`

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `contactId` | string | No | Identifier of the order customer. It must belong to the account of the API key. |
| `projectId` | string | No | Project the order is assigned to; null unlinks it (standalone order). |
| `startDate` | string<date-time> | No | Rental start (ISO 8601 with offset). |
| `endDate` | string<date-time> | No | Rental end (ISO 8601 with offset); it must be later than startDate. |

## Request examples

*Update the header of an order*

**cURL**

```bash
curl https://app.filmo.io/api/v1/orders/orde_8f2a1c \
  --request PATCH \
  --header "Authorization: Bearer $FILMO_API_KEY" \
  --header "Idempotency-Key: $(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)" \
  --header 'Content-Type: application/json' \
  --data '{
  "projectId": "prj_rodaje_otono",
  "startDate": "2026-09-08T08:00:00+02:00",
  "endDate": "2026-09-12T20:00:00+02:00"
}'
```

**Node.js**

```javascript
fetch('https://app.filmo.io/api/v1/orders/orde_8f2a1c', {
  method: 'PATCH',
  headers: {
    Authorization: 'Bearer YOUR_FILMO_API_KEY',
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    projectId: 'prj_rodaje_otono',
    startDate: '2026-09-08T08:00:00+02:00',
    endDate: '2026-09-12T20:00:00+02:00'
  })
})
```

**Python**

```python
import uuid
import requests

requests.patch(
    "https://app.filmo.io/api/v1/orders/orde_8f2a1c",
    headers={
      "Authorization": "Bearer YOUR_FILMO_API_KEY",
      "Idempotency-Key": str(uuid.uuid4()),
      "Content-Type": "application/json"
    },
    json={
      "projectId": "prj_rodaje_otono",
      "startDate": "2026-09-08T08:00:00+02:00",
      "endDate": "2026-09-12T20:00:00+02:00"
    }
)
```

## Response

Response schema: `OrderDetailDto`

| Status | Description |
| --- | --- |
| 200 | Successful response. |
| 400 | Invalid request (validation_error): malformed query or body. `errors[]` lists every offending field with its stable code. |
| 401 | Authentication failed (unauthorized, api_key_invalid, api_key_revoked, api_key_expired, api_key_owner_inactive, api_key_owner_not_admin). |
| 403 | Not allowed (insufficient_scope: the API key does not have the required scope, named in `requiredScope`; forbidden: the owner of the key lacks the permission the operation requires). `insufficient_scope` is answered before the request counts against the rate limit, so it carries no `RateLimit-*` headers; `forbidden` does. |
| 404 | Resource not found (not_found): it does not exist or is outside the scope of the API key. |
| 409 | Conflict (conflict): the current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (`If-Match`) held the resource for more than five seconds. `errors[0].code` says which: `in_progress` and `lock_timeout` are solved by retrying; `invalid_state` is not, because the state of the resource forbids the operation. |
| 412 | Precondition failed (precondition_failed): the `If-Match` entity tag does not match the current representation. Read the resource again and retry. |
| 422 | Idempotency-Key reused (idempotency_key_reused): the same key was used before with a different body. Change the key. |
| 429 | Rate limit exceeded (rate_limited): retry after `Retry-After` seconds; `RateLimit-*` says which quota ran out. |
| 500 | Internal error (internal_error). |

**200**

| Name | Type | Description |
| --- | --- | --- |
| `data` | object | The order in full, as returned by the API. |
| `data.id` | string | Unique order identifier. |
| `data.orderNumber` | string | Human-readable order number. |
| `data.externalReference` | string | External reference of the order (for example, from the customer system); null if not recorded. |
| `data.status` | string | Raw order status as stored in the database (12 values): draft, reserved, prepared_partially, prepared, picked_up_partially, picked_up, returned_partially, returned, checked_in_partially, checked_in, archived or cancelled. `archived` is part of the stored set but an archived order is not visible to the API, so you will not observe it. `draft`, `reserved`, `prepared_partially`, `prepared`, `picked_up_partially`, `picked_up`, `returned_partially`, `returned`, `checked_in_partially`, `checked_in`, `archived`, `cancelled` |
| `data.startDate` | string<date-time> | Start of the rental period in ISO 8601 with offset. |
| `data.endDate` | string<date-time> | End of the rental period in ISO 8601 with offset. |
| `data.rentalDays` | number | Number of billable rental days; null if not calculated. |
| `data.projectId` | string | Identifier of the project the order belongs to; null if not linked. |
| `data.projectName` | string | Name of the project the order belongs to; null if not linked. |
| `data.contact` | object | Compact reference to the order contact; null if none. |
| `data.contact.id` | string | Unique contact identifier. |
| `data.contact.name` | string | Contact name. |
| `data.itemsCount` | integer | Number of items in the order. |
| `data.subTotalPrice` | string | Subtotal before discounts and taxes, as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.discountTotal` | string | Total discounts as a decimal string "1234.50" (ROUND_HALF_UP); null if there is no discount. |
| `data.insuranceTotal` | string | Insurance total as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.depositTotal` | string | Deposit total as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.taxesPrice` | string | Tax total as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.netPrice` | string | Taxable base (net before taxes) as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.grossPrice` | string | Total including taxes, as a decimal string "1234.50" (ROUND_HALF_UP). |
| `data.tags` | object[] | Tags attached to the order, with their identifier and name. |
| `data.tags.id` | string | Unique identifier of the tag. |
| `data.tags.name` | string | Tag name. |
| `data.customFields` | object<string, any> | Custom field values by custom field identifier; the definitions are in `/api/v1/custom-fields`. |
| `data.source` | string | Source the order was created from (for example web, mobile, admin); null if not recorded. |
| `data.createdAt` | string<date-time> | Creation date in ISO 8601 with offset. |
| `data.updatedAt` | string<date-time> | Last update date in ISO 8601 with offset. |
| `data.billingAddress` | object | Billing address of the order; null if none. |
| `data.billingAddress.label` | string | Descriptive label of the address; null if not recorded. |
| `data.billingAddress.addressLine1` | string | First address line; null if not recorded. |
| `data.billingAddress.addressLine2` | string | Second address line; null if not recorded. |
| `data.billingAddress.city` | string | City; null if not recorded. |
| `data.billingAddress.province` | string | Province or region; null if not recorded. |
| `data.billingAddress.postcode` | string | Postal code; null if not recorded. |
| `data.billingAddress.country` | string | Country; null if not recorded. |
| `data.shippingAddress` | object | Shipping address of the order; null if none. |
| `data.shippingAddress.label` | string | Descriptive label of the address; null if not recorded. |
| `data.shippingAddress.addressLine1` | string | First address line; null if not recorded. |
| `data.shippingAddress.addressLine2` | string | Second address line; null if not recorded. |
| `data.shippingAddress.city` | string | City; null if not recorded. |
| `data.shippingAddress.province` | string | Province or region; null if not recorded. |
| `data.shippingAddress.postcode` | string | Postal code; null if not recorded. |
| `data.shippingAddress.country` | string | Country; null if not recorded. |
| `data.contactPerson` | object | Contact person linked to the order; null if none. |
| `data.contactPerson.id` | string | Unique contact identifier. |
| `data.contactPerson.name` | string | Contact name. |
| `data.quotes` | object[] | Informational references to quotes generated from the order. |
| `data.quotes.id` | string | Unique identifier of the referenced document. |
| `data.quotes.number` | string | Document number; null until it is numbered. |
| `data.quotes.status` | string | Document status at the time the reference was written; null if not recorded. Informational: it may be out of date. |
| `data.invoices` | object[] | Informational references to invoices generated from the order. |
| `data.invoices.id` | string | Unique identifier of the referenced document. |
| `data.invoices.number` | string | Document number; null until it is numbered. |
| `data.invoices.status` | string | Document status at the time the reference was written; null if not recorded. Informational: it may be out of date. |
| `data.proformas` | object[] | Informational references to proformas generated from the order. |
| `data.proformas.id` | string | Unique identifier of the referenced document. |
| `data.proformas.number` | string | Document number; null until it is numbered. |
| `data.proformas.status` | string | Document status at the time the reference was written; null if not recorded. Informational: it may be out of date. |
| `meta` | object | Additional information about the response. |
| `meta.warnings` | object[] | Lifecycle warnings; present only when the operation is deprecated. |
| `meta.warnings.code` | string | Stable warning code. `deprecated` |
| `meta.warnings.message` | string | For people: what is deprecated, until when, and what to use. |
| `meta.warnings.sunset` | string | Day (YYYY-MM-DD) the operation stops being served. |
| `meta.warnings.replacement` | string | `operationId` of the operation to use instead, or null if there is none. |
| `meta.warnings.link` | string | Where the deprecation is documented (the changelog). |

*Example response · 200*

```json
{
  "data": {
    "id": "order_9f3a2b",
    "orderNumber": "2026-0001",
    "externalReference": "2026-0001",
    "status": "draft",
    "startDate": "2026-09-01T08:00:00.000Z",
    "endDate": "2026-09-01T08:00:00.000Z",
    "rentalDays": 1,
    "projectId": "project_9f3a2b",
    "projectName": "Example project name",
    "contact": {
      "id": "contact_9f3a2b",
      "name": "Example contact"
    },
    "itemsCount": 1,
    "subTotalPrice": "120.00",
    "discountTotal": "120.00",
    "insuranceTotal": "120.00",
    "depositTotal": "120.00",
    "taxesPrice": "120.00",
    "netPrice": "120.00",
    "grossPrice": "120.00",
    "tags": [
      {
        "id": "tag_9f3a2b",
        "name": "Example tag"
      }
    ],
    "customFields": {
      "example": "example"
    },
    "source": "Example source",
    "createdAt": "2026-09-01T08:00:00.000Z",
    "updatedAt": "2026-09-01T08:00:00.000Z",
    "billingAddress": {
      "label": "Main",
      "addressLine1": "Calle de Ejemplo 12",
      "addressLine2": "Calle de Ejemplo 12",
      "city": "Madrid",
      "province": "Madrid",
      "postcode": "28001",
      "country": "ES"
    },
    "shippingAddress": {
      "label": "Main",
      "addressLine1": "Calle de Ejemplo 12",
      "addressLine2": "Calle de Ejemplo 12",
      "city": "Madrid",
      "province": "Madrid",
      "postcode": "28001",
      "country": "ES"
    },
    "contactPerson": {
      "id": "contact_person_9f3a2b",
      "name": "Example contact person"
    },
    "quotes": [
      {
        "id": "quote_9f3a2b",
        "number": "2026-0001",
        "status": "Example status"
      }
    ],
    "invoices": [
      {
        "id": "invoice_9f3a2b",
        "number": "2026-0001",
        "status": "Example status"
      }
    ],
    "proformas": [
      {
        "id": "proforma_9f3a2b",
        "number": "2026-0001",
        "status": "Example status"
      }
    ]
  }
}
```

## Errors

| Status | Codes | Meaning |
| --- | --- | --- |
| 400 | `validation_error` | Malformed query or body. `errors[]` lists every offending field with its stable code. |
| 404 | `not_found` | It does not exist or is outside the scope of the API key. |
| 409 | `conflict` | The current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (`If-Match`) held the resource for more than five seconds. `errors[0].code` says which: `in_progress` and `lock_timeout` are solved by retrying; `invalid_state` is not, because the state of the resource forbids the operation. |
| 412 | `precondition_failed` | The `If-Match` entity tag does not match the current representation. Read the resource again and retry. |
| 422 | `idempotency_key_reused` | The same key was used before with a different body. Change the key. |

## Deprecation

This operation is not deprecated. Deprecations are announced with a Deprecation header and a sunset date.

---

Canonical URL: https://docs.filmo.io/rest-api/endpoint-reference/orders/update-the-header-of-an-order  
Last updated: 2026-10-25