> ## Documentation Index > Fetch the complete documentation index at: https://docs.laces.run/llms.txt > Use this file to discover all available pages before exploring further. # Get an order > One order with its registrations. Returns personal data. ## OpenAPI ````yaml api-reference/v1/openapi.json GET /orders/{orderId} openapi: 3.1.0 info: title: Laces Partner API version: 1.0.0 summary: Show your organization's races and sell entries from your own website. description: >- The Laces Partner API, served at `https://connect.laces.run/v1`. Every path is relative to that server URL, which already ends in `/v1`. Authenticate with a **bearer token** from `POST /oauth/token` (server side) or, on the routes that allow it, a **publishable key** in `X-Laces-Publishable-Key` (browser side, from an allowed domain). Keys are uppercase and case-sensitive: send them exactly as issued. There is one environment, production. Payments made through the API are real. Money is integer minor units. Every route except the token endpoint answers in the Laces envelope `{ code, message, data | error, error_code }`; branch on `error_code`, never on `message` or `error`. Every response carries an `X-Request-Id` header (`req_…`). Quote it to support@laces.run when something goes wrong. Browsers can read `X-Request-Id` and `Retry-After` (both are CORS-exposed). Rate-limited routes also send the standard `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` headers. Partner credentials are accepted on this host only. Sent to `api.laces.run` (the Laces app's own API), any partner credential is refused with `401 partner_credential_not_accepted`. contact: name: Laces support email: support@laces.run url: https://docs.laces.run license: name: Proprietary identifier: LicenseRef-Proprietary servers: - url: https://connect.laces.run/v1 description: Production security: - bearerAuth: [] tags: - name: Authentication description: OAuth 2.0 client credentials. - name: Events description: Your organization's races that are on sale. - name: Checkout sessions description: 'Laces-hosted checkout: redirect or embedded.' - name: Orders description: Create, pay and read orders from your own UI. - name: Webhook events description: Requests Laces sends to your webhook endpoint. - name: Health description: Liveness probe. paths: /orders/{orderId}: get: tags: - Orders summary: Get an order description: >- One order with its registrations. Use it to poll a pending mobile money payment until `status` leaves `payment_initiated` / `prompt_sent`. **Returns personal data.** Bearer token, scope `orders:read`. operationId: getOrder parameters: - name: orderId in: path required: true schema: type: string example: Hk2mQ8vR responses: '200': description: The order. content: application/json: schema: type: object required: - code - message - data properties: code: type: integer description: HTTP status, repeated in the body. examples: - 200 message: type: string examples: - Order retrieved successfully data: $ref: '#/components/schemas/OrderDetail' example: code: 200 message: Order retrieved successfully data: id: Hk2mQ8vR order_code: LC-7K2M9X event_id: q3Zk9mVx status: paid currency: UGX subtotal: 50000 discount_total: 0 donation_total: 0 laces_fee: 2400 total: 52400 failure_kind: null ticket_count: 1 buyer: name: Amina Nakato email: amina@example.com phone: '+256763494235' attribution: channel: partner_api api_client_id: LCSCLI-EXAMPLECLNT2345EXAMP checkout_session_id: null partner_reference: cart-8841 hold_expires_at: null created_at: '2026-10-09T08:14:03.000Z' registrations: - id: rg_5TfK2 ticket_type_id: tt_10k distance_km: 10 ticket_label: '#AN1' participant_name: Amina Nakato status: confirmed headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/ServerError' security: - bearerAuth: [] - oauth2: - orders:read components: schemas: OrderDetail: allOf: - $ref: '#/components/schemas/Order' - type: object properties: registrations: type: array items: $ref: '#/components/schemas/Registration' required: - registrations Order: type: object properties: id: type: string description: Order id. Pass it to pay and read. examples: - Hk2mQ8vR order_code: type: string description: Human-readable order code shown to the buyer. examples: - LC-7K2M9X event_id: type: string examples: - q3Zk9mVx status: type: string description: Order status. Fulfil only on `paid`. enum: - cart - payment_initiated - prompt_sent - paid - failed - expired - cancelled - refunded - partially_refunded - chargeback_flagged currency: type: string description: ISO 4217 currency code. examples: - UGX subtotal: type: integer description: Ticket prices, minor units. discount_total: type: integer description: Discounts, minor units. donation_total: type: integer description: Donation, minor units. laces_fee: type: integer description: The Laces fee for this cart and payment method, minor units. total: type: integer description: '**Authoritative** amount the buyer pays, minor units.' failure_kind: type: - string - 'null' enum: - provider_not_reached - timed_out - declined - other - null description: >- Why the latest payment attempt failed, as a sanitized bucket; `null` unless the order is `failed` or `expired`. Never the payment provider's own wording. - `provider_not_reached`: the charge never reached the payment provider. **Nothing was charged**; it is safe to retry at once. - `timed_out`: the payer didn't approve in time, or the prompt expired. - `declined`: the payer declined or cancelled, or can't pay (balance, PIN, limit). - `other`: anything else. Treat an unknown value as `other`. See [Why it failed](/guides/custom-ui#why-it-failed-failure-kind). examples: - null ticket_count: type: integer description: Number of tickets. May be absent on some older orders. attribution: type: object properties: channel: type: - string - 'null' description: >- `partner_api` (custom UI), `partner_hosted` (hosted or embedded checkout), or null for an order that did not come through the Partner API. enum: - partner_api - partner_hosted - null api_client_id: type: - string - 'null' description: The API client that created the order. examples: - LCSCLI-EXAMPLECLNT2345EXAMP checkout_session_id: type: - string - 'null' description: The checkout session the order came from. examples: - null partner_reference: type: - string - 'null' description: Your `partner_reference` from order creation. examples: - cart-8841 required: - channel - api_client_id - checkout_session_id - partner_reference description: How the order came in. hold_expires_at: type: - string - 'null' description: When the inventory hold lapses if the order is not paid. format: date-time created_at: type: string format: date-time buyer: type: object properties: name: type: string email: type: string format: email phone: type: string description: E.164, for example `+256763494235`. examples: - '+256763494235' description: >- The buyer. Keys are omitted when empty; `phone` is E.164 (`+256763494235`). **Personal data.** required: - id - order_code - event_id - status - currency - subtotal - discount_total - donation_total - laces_fee - total - attribution - hold_expires_at - created_at description: >- An order as the Partner API shows it. Provider internals, processing fees and idempotency keys are never included. Registration: type: object properties: id: type: string ticket_type_id: type: string examples: - tt_10k distance_km: type: number ticket_label: type: string examples: - '#AN1' participant_name: type: - string - 'null' status: type: string enum: - pending - unclaimed - confirmed - transferred - cancelled - refunded required: - id - ticket_type_id - participant_name - status Error: type: object properties: code: type: integer description: HTTP status, repeated in the body. message: type: string description: Short outcome. Do not branch on it; it may be reworded. error: type: string description: Human-readable detail. May be reworded; never parse it. error_code: type: string description: >- Stable machine-readable code. **Branch on this.** Present on every Partner API error, including `429 rate_limited`, `404 not_found` for unknown routes and `500 server_error`. See the [error reference](/concepts/errors). details: type: object properties: retry_after_seconds: type: integer description: Only on `409 prompt_in_progress`. required: - code - message - error - error_code description: The Laces error envelope. headers: X-Request-Id: description: >- Unique id of this request (`req_…`). On every response, readable from browsers. Quote it to support. schema: type: string example: req_V1StGXR8Z5jdHi6BmyTq Retry-After: description: Whole seconds to wait before retrying. Readable from browsers. schema: type: integer RateLimit-Limit: description: Requests allowed in the current window. schema: type: integer RateLimit-Remaining: description: Requests left in the current window. schema: type: integer RateLimit-Reset: description: Seconds until the window resets. schema: type: integer responses: Unauthorized: description: >- No credential, an invalid or expired token, or an invalid publishable key. Comes with `WWW-Authenticate: Bearer realm="laces-partner"`. Revoking or regenerating keys can take up to a minute to reach every server. content: application/json: schema: $ref: '#/components/schemas/Error' examples: unauthorized: summary: unauthorized value: code: 401 message: Unauthorized error: Missing credentials error_code: unauthorized invalid_token: summary: invalid_token value: code: 401 message: Unauthorized error: Invalid or expired access token error_code: invalid_token invalid_key: summary: invalid_key value: code: 401 message: Unauthorized error: Invalid publishable key error_code: invalid_key headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' Forbidden: description: >- The credential is not allowed here: a missing scope (scope changes take up to about a minute to apply), a publishable key on a bearer-only route, or a publishable key from an origin that is not an allowed domain. content: application/json: schema: $ref: '#/components/schemas/Error' examples: insufficient_scope: summary: insufficient_scope value: code: 403 message: Forbidden error: 'Missing scope: orders:read' error_code: insufficient_scope credential_not_permitted: summary: credential_not_permitted value: code: 403 message: Forbidden error: This endpoint does not accept a publishable key error_code: credential_not_permitted origin_not_allowed: summary: origin_not_allowed value: code: 403 message: Forbidden error: This origin is not allowed for this key error_code: origin_not_allowed headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' NotFound: description: >- Not found, or it belongs to another organization (the same answer, so existence never leaks). content: application/json: schema: $ref: '#/components/schemas/Error' examples: not_found: summary: not_found value: code: 404 message: Not found error: Event not found error_code: not_found headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimited: description: >- Rate limited. Wait `Retry-After` seconds. Limits are per API client (reads about 300 a minute, writes about 60) and, for publishable keys, also per IP (about 120 a minute). headers: Retry-After: $ref: '#/components/headers/Retry-After' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/json: schema: $ref: '#/components/schemas/Error' example: code: 429 message: Too many requests, please slow down error: rate_limited error_code: rate_limited ServerError: description: >- Unexpected failure. Retry with backoff, reusing the same `Idempotency-Key`. content: application/json: schema: $ref: '#/components/schemas/Error' examples: server_error: summary: server_error value: code: 500 message: An unexpected error occurred error: Something went wrong error_code: server_error headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: LCSTOK-…-X (opaque) description: >- A token from `POST /oauth/token`, valid 1 hour. Paste it as `LCSTOK-…-X` (without the word Bearer). oauth2: type: oauth2 description: >- OAuth 2.0 client credentials. The token it yields is the `bearerAuth` token. flows: clientCredentials: tokenUrl: https://connect.laces.run/v1/oauth/token scopes: events:read: List and read events orders:write: Create and pay orders orders:read: >- List and read orders, including buyer personal data (off by default) checkout_sessions:write: Create and read checkout sessions ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.