Skip to main content
PATCH
Transition an order through its state machine

Authorizations

Authorization
string
header
required

Authorization: Basic base64(partner_key:secret_key).

Credentials are issued by a klikit operator. The plaintext secret_key is shown once at issuance and cannot be retrieved later — store it securely. If lost, ask your operator to rotate the secret to receive a new one. The old secret stops working immediately on rotation; there is no overlap window.

Headers

Idempotency-Key
string
required

Stable client-supplied token. Same key + same body within 24h replays the cached response; same key + different body returns 409 state_idempotency_conflict. Use a UUID per logical write.

Path Parameters

id
string
required

Body

application/json
status
enum<string>
required
Available options:
accepted,
ready,
picked_up,
rejected,
cancelled
reason_code
string

Required for rejected and cancelled transitions.

occurred_at
string<date-time>

Response

Status update accepted

Canonical response wrapper. Every response — success or error — carries the request_id so you can quote one id to klikit support to correlate a request end-to-end.

request_id
string
required
Example:

"req_4d1b7e3f-..."

data
object

Endpoint-specific payload on success.

error
object

Machine-readable error code + human message. The code is stable across releases — switch on code in your client code rather than parsing the message text.

Common codes you will encounter as a partner: