# Get Order

Get an order by its ID.

Endpoint: GET /v1/orders/{orderId}
Security: OAuth2

## Security:

  - `OAuth2` (unknown)
    oauth2 scopes: order.read

## Path parameters:

  - `orderId` (string, required)
    The unique identifier of the order.

## Response 200:

  - `200` (unknown)
    OK

## Response 200 fields (application/json):

  - `id` (string, required)
    The unique identifier of the order.

  - `number` (string)
    A sequential, human-readable order number.

  - `status` (string, required)
    The lifecycle status of an order.
- `PENDING` — created but not yet finalized; payment may still be in progress.
- `COMPLETED` — finalized; payment has settled and the order is closed.
- `CANCELLED` — cancelled; the order will not be fulfilled.
    Enum: "PENDING", "COMPLETED", "CANCELLED"

  - `created_at` (string, required)
    Timestamp of when the order was created.

  - `updated_at` (string, required)
    Timestamp of when the order was last updated.

  - `customer` (any, required)
    The customer that placed the order.

  - `customer.customer_type` (string, required)
    Enum: "PRIVATE", "COMPANY"

  - `customer.full_name` (string, required)
    The name of the customer.

  - `customer.email` (string, required)
    The email address of the customer.

  - `customer.phone` (string, required)
    The phone number of the customer.

  - `customer.address` (object)
    An address recorded on an order, which may be partial.

  - `customer.address.address_lines` (array, required)
    Address lines.
The first line is the primary address line, e.g. street name and number.
The second line is the secondary address line, e.g. apartment number.
Empty when the recorded address has no street address.

  - `customer.address.city` (string, required)
    The city of the customer.

  - `customer.address.zip_code` (string, required)
    The postal code of the customer.

  - `customer.address.region` (string)
    The region of the customer.
This can be a state, province, or other administrative region.

  - `customer.address.country` (string, required)
    The country of the customer.

  - `customer.company_name` (string, required)
    The name of the company.

  - `customer.vat_number` (string, required)
    The VAT number of the company.

  - `customer.name` (string)
    The name of the customer.

  - `origin` (any, required)
    The origin of the order.

  - `origin.type` (string, required)
    The type discriminator for booking origin.
    Enum: "BOOKING"

  - `origin.id` (string, required)
    The unique identifier of the booking.

  - `origin.type` (string, required)
    The type discriminator for gift card origin.
    Enum: "GIFTCARD"

  - `origin.id` (string, required)
    The unique identifier of the gift card.

  - `totals` (object, required)
    Financial summary of the order.

  - `totals.discount` (object, required)

  - `totals.discount.currency` (string, required)
    The ISO 4217 currency code.
    Example: USD

  - `totals.discount.value` (integer, required)
    The price in the smallest currency unit (e.g. cents for USD).
    Example: 2500

  - `totals.discount.exponent` (integer, required)
    The number of decimal places for the currency.
    Example: 2

  - `metadata` (object)
    A set of key-value pairs that are attached to the order for storing additional information.

## Response 400:

  - `400` (unknown)
    Bad request.

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code. Each code always comes with the same HTTP status:
`BAD_REQUEST` (400), `UNAUTHORIZED` (401), `FORBIDDEN` (403), `NOT_FOUND` (404),
`CONFLICT` (409), `PRECONDITION_FAILED` (412), `TOO_MANY_REQUESTS` (429),
`INTERNAL_SERVER_ERROR` (500), `NOT_IMPLEMENTED` (501), `SERVICE_UNAVAILABLE` (503)
and `GATEWAY_TIMEOUT` (504).
The list is extensible: handle an unknown code by its HTTP status.
    Example: BAD_REQUEST

  - `message` (string, required)
    Human-readable description of the error, and how to resolve it where possible.

## Response 403:

  - `403` (unknown)
    Forbidden.

## Response 403 fields (application/json):

  - `code` (string, required)
    Machine-readable error code. Each code always comes with the same HTTP status:
`BAD_REQUEST` (400), `UNAUTHORIZED` (401), `FORBIDDEN` (403), `NOT_FOUND` (404),
`CONFLICT` (409), `PRECONDITION_FAILED` (412), `TOO_MANY_REQUESTS` (429),
`INTERNAL_SERVER_ERROR` (500), `NOT_IMPLEMENTED` (501), `SERVICE_UNAVAILABLE` (503)
and `GATEWAY_TIMEOUT` (504).
The list is extensible: handle an unknown code by its HTTP status.
    Example: BAD_REQUEST

  - `message` (string, required)
    Human-readable description of the error, and how to resolve it where possible.

## Response 404:

  - `404` (unknown)
    Not found.

## Response 404 fields (application/json):

  - `code` (string, required)
    Machine-readable error code. Each code always comes with the same HTTP status:
`BAD_REQUEST` (400), `UNAUTHORIZED` (401), `FORBIDDEN` (403), `NOT_FOUND` (404),
`CONFLICT` (409), `PRECONDITION_FAILED` (412), `TOO_MANY_REQUESTS` (429),
`INTERNAL_SERVER_ERROR` (500), `NOT_IMPLEMENTED` (501), `SERVICE_UNAVAILABLE` (503)
and `GATEWAY_TIMEOUT` (504).
The list is extensible: handle an unknown code by its HTTP status.
    Example: BAD_REQUEST

  - `message` (string, required)
    Human-readable description of the error, and how to resolve it where possible.

## Response default:

  - `default` (unknown)
    Unexpected error.
This will be a 5XX status code.

## Response default fields (application/json):

  - `code` (string, required)
    Machine-readable error code. Each code always comes with the same HTTP status:
`BAD_REQUEST` (400), `UNAUTHORIZED` (401), `FORBIDDEN` (403), `NOT_FOUND` (404),
`CONFLICT` (409), `PRECONDITION_FAILED` (412), `TOO_MANY_REQUESTS` (429),
`INTERNAL_SERVER_ERROR` (500), `NOT_IMPLEMENTED` (501), `SERVICE_UNAVAILABLE` (503)
and `GATEWAY_TIMEOUT` (504).
The list is extensible: handle an unknown code by its HTTP status.
    Example: BAD_REQUEST

  - `message` (string, required)
    Human-readable description of the error, and how to resolve it where possible.