# Get Transactions

Get all transactions for an order.

Endpoint: GET /v1/orders/{orderId}/transactions
Security: OAuth2

## Security:

  - `OAuth2` (unknown)
    oauth2 scopes: order.read

## Path parameters:

  - `orderId` (string, required)
    The unique identifier of the order.

## Response 200:

  - `200` (unknown)
    OK

## Response 200 fields (application/json):

  - `items` (array)

  - `items.id` (string, required)
    The unique identifier of the transaction.

  - `items.status` (string, required)
    The status of a transaction.
- `UNPAID` — recorded but not yet settled.
- `PAID` — settled.
- `REFUNDED_PARTIALLY` — settled; some of the amount has been refunded.
- `REFUNDED_FULLY` — settled; the full amount has been refunded.
    Enum: "UNPAID", "PAID", "REFUNDED_PARTIALLY", "REFUNDED_FULLY"

  - `items.provider` (string, required)
    The payment provider that processed the transaction.
- `UNDERSTORY_PAY` — Understory's own payment offering.
- `STRIPE` — Stripe.
- `PAYPAL` — PayPal.
- `QUICKPAY` — QuickPay.
- `GIFTCARD` — payment redeemed against a gift card balance.
- `PUNCHCARD` — payment redeemed against a punch card balance.
- `SETTLEMENT` — a refund on another order was used to fund this order, `details` names the order it came from.
- `EXTERNAL` — payment was received in another system and marked as paid within Understory.
- `INTEGRATION` — the booking came through a reseller integration, and the reseller collected the payment.
- `UNKNOWN` — defensive default; should not appear on a correctly configured transaction.
    Enum: "UNDERSTORY_PAY", "STRIPE", "PAYPAL", "QUICKPAY", "GIFTCARD", "PUNCHCARD", "SETTLEMENT", "EXTERNAL", "INTEGRATION", "UNKNOWN"

  - `items.amount` (object, required)

  - `items.amount.currency` (string, required)
    The ISO 4217 currency code.
    Example: USD

  - `items.amount.value` (integer, required)
    The price in the smallest currency unit (e.g. cents for USD).
    Example: 2500

  - `items.amount.exponent` (integer, required)
    The number of decimal places for the currency.
    Example: 2

  - `items.details` (any)
    Provider-specific details for the transaction, if applicable.

  - `items.details.type` (string, required)
    The type of transaction details.
    Enum: "GIFTCARD", "SETTLEMENT"

  - `items.details.gift_card_id` (string, required)
    The unique identifier of the gift card.

  - `items.details.origin_order_id` (string, required)
    The unique identifier of the order whose payment funded this settlement.

  - `items.created_at` (string, required)
    Timestamp of when the transaction was created.

## Response 400:

  - `400` (unknown)
    Bad request.

## Response 400 fields (application/json):

  - `code` (string, required)
    Machine-readable error code. Each code always comes with the same HTTP status:
`BAD_REQUEST` (400), `UNAUTHORIZED` (401), `FORBIDDEN` (403), `NOT_FOUND` (404),
`CONFLICT` (409), `PRECONDITION_FAILED` (412), `TOO_MANY_REQUESTS` (429),
`INTERNAL_SERVER_ERROR` (500), `NOT_IMPLEMENTED` (501), `SERVICE_UNAVAILABLE` (503)
and `GATEWAY_TIMEOUT` (504).
The list is extensible: handle an unknown code by its HTTP status.
    Example: BAD_REQUEST

  - `message` (string, required)
    Human-readable description of the error, and how to resolve it where possible.

## Response 404:

  - `404` (unknown)
    Not found.

## Response 404 fields (application/json):

  - `code` (string, required)
    Machine-readable error code. Each code always comes with the same HTTP status:
`BAD_REQUEST` (400), `UNAUTHORIZED` (401), `FORBIDDEN` (403), `NOT_FOUND` (404),
`CONFLICT` (409), `PRECONDITION_FAILED` (412), `TOO_MANY_REQUESTS` (429),
`INTERNAL_SERVER_ERROR` (500), `NOT_IMPLEMENTED` (501), `SERVICE_UNAVAILABLE` (503)
and `GATEWAY_TIMEOUT` (504).
The list is extensible: handle an unknown code by its HTTP status.
    Example: BAD_REQUEST

  - `message` (string, required)
    Human-readable description of the error, and how to resolve it where possible.

## Response default:

  - `default` (unknown)
    Unexpected error.
This will be a 5XX status code.

## Response default fields (application/json):

  - `code` (string, required)
    Machine-readable error code. Each code always comes with the same HTTP status:
`BAD_REQUEST` (400), `UNAUTHORIZED` (401), `FORBIDDEN` (403), `NOT_FOUND` (404),
`CONFLICT` (409), `PRECONDITION_FAILED` (412), `TOO_MANY_REQUESTS` (429),
`INTERNAL_SERVER_ERROR` (500), `NOT_IMPLEMENTED` (501), `SERVICE_UNAVAILABLE` (503)
and `GATEWAY_TIMEOUT` (504).
The list is extensible: handle an unknown code by its HTTP status.
    Example: BAD_REQUEST

  - `message` (string, required)
    Human-readable description of the error, and how to resolve it where possible.