List an order's shipments, with tracking

GET

/orders/{orderNumber}/shipments

curl --request GET \
  --url 'https://api.partners.collaterate.com/v1/orders/1/shipments?limit=25' \
  --header 'Authorization: Bearer <token>'

• Production (OAuth2 client_credentials, bearer token)
• Production (mutual TLS -- see "Authentication" below; only for partners onboarded this way)
• Staging (OAuth2 client_credentials, bearer token)
• Staging (mutual TLS)
• Test-B (OAuth2 client_credentials, bearer token)
• Test-B (mutual TLS)

Every shipment of one order, keyset-paginated, with its packages nested inside it. This is the endpoint to poll for tracking information.

Which field carries the tracking number

Read trackingNumbers. It is an array of strings, never null, and it applies the published precedence rule below so that you do not have to.

Collaterate records tracking numbers in two independent places, and they are complementary, not a deprecated pair – both are in active use today:

• a per-package number, issued by the carrier when a label is generated. This is the usual path (61.5% of shipments in the last twelve months) and it produces one number per package, so a shipment can carry several.
• a shipment-level manual number, typed in by a person for a shipment that did not go through carrier-integrated label generation (5.7% of shipments).

The rule: per-package numbers win where any exist; otherwise the manual shipment-level number is used; otherwise trackingNumbers is empty. On the very few shipments carrying both (47 in twelve months, 0.01%), the per-package numbers win, because those are the numbers the carrier itself issued against a real label.

Both raw sources remain visible – manualTrackingNumber on the shipment and packages[].trackingNumber – so you can tell where a number came from. Do not reimplement the precedence from them; read trackingNumbers.

The invariant that tells you when to stop polling

A shipment that has shipped always has tracking. Across 347,201 shipments in the last twelve months, every single one of the 113,897 with no tracking at all also had shippedOn: null – zero exceptions. Tracking is absent only before a shipment goes out, and never after.

So: an empty trackingNumbers together with shippedOn: null means “not shipped yet, keep polling”. An empty trackingNumbers on a shipment whose shippedOn is set would be a data fault worth reporting to Partner Integrations, not a state to code around.

No carrier name field

There is no carrier. shippingService carries it: shipped shipments always have a service name and it reads FedEx Ground, UPS Ground, FedEx Priority Overnight and so on. The carrier is stored as a foreign key to a table that has no site of its own, which cannot be joined without dropping the 33% of shipments that have no carrier assigned yet – which is precisely the set you are polling. See the shipments guide.

Authorizations

• oauth2
  partner-api/orders:read
• mtls

Parameters

Path Parameters

orderNumber

required

integer

Query Parameters

cursor

string

Opaque pagination token from a previous response’s nextCursor. Treat it as opaque: do not parse it, do not construct one, and do not pass a cursor from a different endpoint – cursors are endpoint-specific and a foreign one is rejected as 400 invalid_cursor rather than silently returning the wrong page.

limit

integer

default: 25 >= 1 <= 50

Page size. Defaults to 25, capped at 50 (lower than /v1/orders because each shipment carries a nested package array). A value that is not a positive integer falls back to the default rather than erroring.

Responses

200

A page of shipments. An order that exists and has no shipments yet returns an empty array with nextCursor: null – that is a normal, expected answer and means “keep polling”, not “wrong order number”. A 404 is what means the latter.

Media typeapplication/json

object

shipments

required

Array<object>

One shipment of one order. There is no shipment id: a shipment is identified by (orderNumber, shipmentNumber).

object

orderNumber

required

integer

siteId

required

integer

shipmentNumber

required

The shipment’s number within its order. Unique within an order, and in practice always present – it is typed as nullable because the underlying column is, and this API does not claim a constraint the database does not enforce.

integer | null

shippingService

required

The carrier service, for example FedEx Ground or UPS Next Day Air®. null until a service is chosen, which in practice means the shipment has not shipped. There is no separate carrier field – see the operation description.

string | null

trackingNumbers

required

The field to read for tracking. Distinct carrier-issued numbers for this shipment’s packages where any exist, otherwise the single manual shipment-level number, otherwise empty. Never null; an empty array means no tracking exists yet, which by the shipped-implies-tracked invariant means shippedOn is null too. See the operation description for the full precedence rule.

Array<string>

manualTrackingNumber

required

The raw shipment-level, hand-entered number, exposed so you can tell which source a number in trackingNumbers came from. Do not reimplement the precedence rule from this field and packages[].trackingNumber.

string | null

shippedOn

required

When the shipment actually went out, or null if it has not. Together with an empty trackingNumbers this is the signal to keep polling.

string | null format: date-time

deliveredOn

required

When the carrier reported delivery, or null.

string | null format: date-time

estimatedShipBy

required

Current internal estimate of when this will ship. An estimate, not a commitment.

string | null format: date-time

shipBy

required

The date the shipment is targeted to leave by.

string | null format: date-time

deliverBy

required

The date the shipment is targeted to arrive by.

string | null format: date-time

shipTo

required

Where this shipment is going. Same shape and same vocabulary as the shipTo you send on POST /v1/orders – state is an abbreviation, country a two-letter code – so an address reads the same coming back as it did going out.

object

company

required

string | null

firstName

required

string | null

lastName

required

string | null

address1

required

string | null

address2

required

string | null

city

required

string | null

state

required

State or province abbreviation. null where the address has no state.

string | null

country

required

Two-letter country abbreviation.

string | null

postalCode

required

string | null

phone

required

string | null

residential

required

Whether the carrier treats this as a residential address, which affects both the rate and the delivery window. Roughly one shipment in seven.

boolean

fulfilment

required

Where the shipment is before it ships.

object

shipmentCreated

required

The shipment record has been created in the fulfilment system.

boolean

ready

required

Ready to ship. null means not recorded, which is not the same as false – it is the only one of the three that can be absent.

boolean | null

picked

required

The contents have been picked.

boolean

shipmentIdNumber

required

The fulfilment system’s own text identifier for this shipment.

string | null

referenceNumber1

required

Free-text reference carried on the shipment, and the field most often quoted back in a support conversation. Present on roughly four shipments in five.

string | null

referenceNumber2

required

A second reference field. See referenceNumber1.

string | null

shippingTotal

required

What this shipment’s shipping cost the buyer, after adjustments, as a decimal string – same precision rule as OrderTotals, so parse it with a decimal library and never parseFloat.

This is a price, not a cost. What the carrier charged Collaterate is not published.

string | null

blindShip

required

Whether this shipment went out blind, i.e. without Collaterate branding on the packing slip or label. Roughly one shipment in eight.

boolean

packages

required

The shipment’s packages, empty when none have been created. Complete unless the response’s packagesComplete is false.

Array<object>

One physical package within a shipment. This is where a carrier-issued tracking number lives.

object

sequence

required

The fulfilment system’s package sequence within its shipment. An ordering hint and not a key: it is neither guaranteed unique nor gap-free, and repeated values do occur. Do not use it to correlate a package across two polls.

integer

trackingNumber

required

The carrier-issued number for this package, or null when no label has been generated for it yet. Prefer the shipment’s trackingNumbers, which already applies the precedence rule, over collecting these yourself.

string | null

weight

required

The package’s weight, as a decimal string – same precision rule as OrderTotals; parse with a decimal library, never parseFloat.

Present on effectively every package. The unit is pounds by platform convention, and that convention is not enforced by a column or a constraint anywhere – there is no unit recorded with the value. Treat it as lb, and do not build anything that would be unsafe if a future record disagreed.

string | null

length

required

Decimal string. Inches by the same convention as weight, and with the same caveat.

Dimensions are much thinner than weight – roughly three packages in five carry them – so expect null and handle it. All three dimensions are populated or absent together in practice, but that is an observation, not a guarantee: test each.

string | null

width

required

Decimal string, inches. See length.

string | null

height

required

Decimal string, inches. See length.

string | null

nextCursor

required

Opaque cursor for the next page, or null when this is the last page. Terminate your loop on null and on nothing else.

string | null

packagesComplete

required

true in effectively every response. false means this response hit the per-response package ceiling (5,000), so at least one shipment’s packages – and therefore its trackingNumbers – is incomplete. Re-request with a smaller limit; do not treat the tracking numbers in that response as the full set. This is reported rather than truncated silently because a missing tracking number arriving as a well-formed 200 is undetectable from your side.

boolean

Examples

Exampledefault

{
  "shipments": [
    {
      "orderNumber": 1000234,
      "siteId": 7,
      "shipmentNumber": 1,
      "shippingService": "FedEx Ground",
      "trackingNumbers": [
        "794658123456",
        "794658123457"
      ],
      "manualTrackingNumber": null,
      "shippedOn": "2026-06-03T09:10:00.000Z",
      "deliveredOn": "2026-06-05T16:41:00.000Z",
      "estimatedShipBy": "2026-06-03T00:00:00.000Z",
      "shipBy": "2026-06-04T00:00:00.000Z",
      "deliverBy": "2026-06-06T00:00:00.000Z",
      "packages": [
        {
          "sequence": 1,
          "trackingNumber": "794658123456"
        },
        {
          "sequence": 2,
          "trackingNumber": "794658123457"
        }
      ]
    },
    {
      "orderNumber": 1000234,
      "siteId": 7,
      "shipmentNumber": 2,
      "shippingService": null,
      "trackingNumbers": [],
      "manualTrackingNumber": null,
      "shippedOn": null,
      "deliveredOn": null,
      "estimatedShipBy": "2026-06-10T00:00:00.000Z",
      "shipBy": "2026-06-11T00:00:00.000Z",
      "deliverBy": null,
      "packages": []
    }
  ],
  "nextCursor": null,
  "packagesComplete": true
}

400

The order number in the path is not a positive integer, cursor could not be decoded, or any other query parameter this endpoint does not accept (unknown_query_parameter). A well-formed order number you are not entitled to see is a 404.

Media typeapplication/problem+json

RFC 9457 application/problem+json body. code is the published, stable, machine-readable field to branch your integration logic on – detail is a human-readable string that may be reworded over time and must not be parsed.

This table is the whole published set: every code this API can return appears below, and nothing below is unreachable. test/docs/openapi-matches-reality.test.ts compares the enum to the codes the handlers actually construct, so a code added to one side and not the other fails the build rather than shipping.

Published code values:

code	HTTP status	Meaning	Retry?
invalid_cursor	400	The cursor query parameter could not be decoded.	No – restart pagination with no cursor. Do not resend the same value.
invalid_site_id	400	The siteId filter is not a positive integer, or it names a site outside your grant. detail says which.	No – fix the parameter against GET /v1/me’s grantedSiteIds.
invalid_order_number	400	The order number in the path is not a positive integer.	No – fix the path.
invalid_product_id	400	The productId path segment on GET /v1/products/{productId} does not match the SLO_/SLS_-prefixed shape.	No – fix the path.
invalid_service_type	400	GET /v1/products’s serviceType filter is not one of the values this API can order (STOCK or POD).	No – fix the parameter.
updated_since_not_supported	400	An updatedSince parameter was sent. Rejected rather than ignored, on purpose – see “No updatedSince / no change polling” above.	No – remove the parameter; there is no change-polling mechanism to switch to.
invalid_request	400	POST /v1/orders’s request body failed validation – malformed JSON, a missing or malformed field, an unknown key, or a body-level rule such as partnerLineId uniqueness or a misplaced shipTo – or GET /v1/orders/submissions’s status/limit filter is malformed. detail names the exact violation.	No – fix the request.
invalid_submission_id	400	The submissionId path segment on GET /v1/orders/submissions/{submissionId} is not a well-formed UUID.	No – fix the path.
invalid_quantity	400	The quantity on POST /v1/products/{productId}/quote is missing or not a positive integer.	No – fix the request body.
invalid_shipping_quote_request	400	POST /v1/shipping/quote’s body failed validation – malformed JSON, a missing or mistyped field, an unknown key at the top level or inside shipTo, or a weightOunces outside 0 < w <= 5000000. detail names the field.	No – fix the request body.
invalid_item_number	400	The itemNumber path segment on a proof route is not a positive integer. It is the line’s itemNumber from GET /v1/orders/{orderNumber}/items, never a Collaterate internal id.	No – fix the path.
invalid_token	401	The credential is missing, expired, or invalid.	No – mint a new token, retry once, then investigate the credential.
insufficient_scope	403	The token lacks the scope required for this operation.	No – mint a token with the required scope.
order_not_found	404	No such order, or one that exists outside your granted sites (see above).	No.
order_item_not_found	404	No line matching (orderNumber, itemNumber) resolves for you – absent, outside your granted sites, or hidden from the customer, identically.	No.
product_not_found	404	No such product, or one that exists but belongs to a site outside your granted sites (same rule as order_not_found).	No.
quote_product_not_found	404	The product resolved in our own catalog but Collaterate could not price it. Rare.	No.
template_not_found	404	GET /v1/products/{productId}/template found no Chili template for this product – not TEMPLATE-classified, TEMPLATE-classified with a legacy EDOC/CANVA vendor, or Chili-templated with no document configured. All three identically.	No.
submission_not_found	404	No submission exists with this id for your credential – whether it never existed or belongs to another partner, identically.	No.
ordering_not_provisioned	409	POST /v1/orders’s siteId has no ordering user configured. This is set up per (partner, site) by staff at onboarding; a partner cannot provision it themselves.	No – ask Partner Integrations to provision an ordering user for the site, then retry.
partner_order_id_reused	409	POST /v1/orders’s partnerOrderId was already used, with a request body that does not match this one. Resending the identical body under the same partnerOrderId is safe and returns the original submission (see the operation description); reusing it for a materially different order is rejected instead of silently creating a second order.	No – use a new partnerOrderId, or resend the exact original body to poll the existing submission.
proof_not_pending_review	409	A proof approve or decline was sent for a line whose proofStatus is not PENDING_REVIEW – no proof yet, already decided, or a state this API does not recognise. detail says which. On a RETRY of a decision that already succeeded, this is the expected answer and means success.	No – read the line’s current proofStatus from GET /v1/orders/{orderNumber}/items.
order_item_cancelled	409	A proof approve or decline was sent for a cancelled line. It will never be produced, so its proof cannot be decided.	No.
quote_invalid	422	Collaterate rejected the quote on business-validation grounds (e.g. quantity over the product’s configured maximum). detail carries Collaterate’s own validation message.	No – fix the request body (e.g. reduce quantity).
unknown_country_code	422	POST /v1/shipping/quote’s shipTo.country is not a country code Collaterate recognises.	No – send a code Collaterate carries (US, CA, MX, …).
unknown_state_code	422	POST /v1/shipping/quote’s shipTo.state is not a state or province of the country you sent. State codes are resolved WITHIN the country, since they are not unique across countries.	No – fix the state, or the country it belongs to.
shipping_quote_unavailable	422	POST /v1/shipping/quote produced no priced service at all for that destination and weight. detail carries Collaterate’s own reasons when it gave any – an invalid postal code for the country is the common one – and says so plainly when it did not.	No – fix the destination. An empty result is never returned as a 200.
denial_reason_not_available	422	POST .../proof/decline’s reason is well-formed but is not a denial reason this line’s proof offers – including a code that is valid on a different line, and UNKNOWN, which never is. detail lists what is valid here.	No – pick a code from GET .../proof/denial-reasons for this line.
rate_limit_exceeded	429	Rate limit or daily quota exceeded.	Yes – honor Retry-After.
internal_error	500	Unexpected server-side failure. Detail is always the fixed string below, never the underlying error.	No, or with caution – if persistent, contact Partner Integrations.
service_unavailable	503	Transient failure – typically the database path, but also a Lambda that crashed, timed out, or hit its own concurrency limit before any handler ran.	Yes, with backoff.

Three statuses are answered by the API gateway before your request reaches application code: 401 (authorizer denial), 429 (usage-plan throttle), and 503 (the Lambda integration itself failed). All three are configured to return this same document with the codes above, so one parser and one branch on code covers every error this API produces. The 403 on GET /v1/ping is the sole exception anywhere in the API – it comes from the edge firewall, which is not ours to shape, and carries no problem document.

object

type

required

Always the literal string about:blank today; reserved by RFC 9457 for future use.

string

Allowed value: about:blank

title

required

Short, human-readable summary of the HTTP status (e.g. “Not Found”).

string

status

required

The HTTP status code, repeated in the body for convenience.

integer

code

required

Stable, machine-readable error identifier. Safe to branch on. See the table above.

string

Allowed values: all_segments_visible_reset_not_acknowledged artwork_reservation_not_usable audit_unavailable auto_assigned_segments_present credit_account_not_found cursor_not_supported_with_search denial_reason_not_available division_code_conflict division_create_requires_address division_not_found division_not_on_site division_parent_invalid image_not_found insufficient_scope internal_error invalid_active invalid_adjustment_type invalid_cursor invalid_credit_account_id invalid_division_id invalid_image_id invalid_image_patch invalid_item_number invalid_order_number invalid_product_id invalid_product_patch invalid_quantity invalid_query invalid_request invalid_segment_ids invalid_segments_body invalid_service_type invalid_shipping_quote_request invalid_site_id invalid_submission_id invalid_token invalid_user_id invalid_variant_id invalid_variant_patch monolith_rejected monolith_target_missing null_not_supported order_item_cancelled order_item_not_found order_not_found ordering_not_provisioned parent_is_self parent_not_on_site partner_order_id_reused product_not_found product_write_partially_applied proof_not_pending_review quote_invalid quote_product_not_found rate_limit_exceeded search_not_available segment_not_on_site service_unavailable shipping_quote_unavailable site_id_required_for_search site_not_found sls_null_backfills_master submission_not_found template_not_found unknown_country_code unknown_query_parameter unknown_state_code unsupported_field_for_service_type updated_since_not_supported user_already_exists user_not_found variant_not_site_addressable

detail

required

Human-readable explanation. Do not parse this – it may be reworded without notice.

string

requestId

required

Echoes the request’s id. Include this when contacting Partner Integrations about a specific failed call – it resolves directly to one log entry.

string

Examples

{
  "type": "about:blank",
  "title": "Bad Request",
  "status": 400,
  "code": "invalid_order_number",
  "detail": "\"orderNumber\" must be a positive integer, got: 10-0234",
  "requestId": "8f3c1e2a-..."
}

{
  "type": "about:blank",
  "title": "Bad Request",
  "status": 400,
  "code": "invalid_cursor",
  "detail": "The \"cursor\" query parameter is malformed.",
  "requestId": "8f3c1e2a-..."
}

401

Missing, expired, or otherwise invalid credential. Not retryable as-is.

Produced by the API gateway’s authorizer, before the request reaches any application code, so every cause – no Authorization header, a malformed one, a token that is expired, wrongly signed, from the wrong pool, or belongs to a credential that has been disabled – yields this identical response. The gateway is configured to answer in the same application/problem+json shape as everything else, so you do not need a second parser for this status; what it cannot do is tell you which of those causes applied.

Media typeapplication/problem+json

RFC 9457 application/problem+json body. code is the published, stable, machine-readable field to branch your integration logic on – detail is a human-readable string that may be reworded over time and must not be parsed.

This table is the whole published set: every code this API can return appears below, and nothing below is unreachable. test/docs/openapi-matches-reality.test.ts compares the enum to the codes the handlers actually construct, so a code added to one side and not the other fails the build rather than shipping.

Published code values:

code	HTTP status	Meaning	Retry?
invalid_cursor	400	The cursor query parameter could not be decoded.	No – restart pagination with no cursor. Do not resend the same value.
invalid_site_id	400	The siteId filter is not a positive integer, or it names a site outside your grant. detail says which.	No – fix the parameter against GET /v1/me’s grantedSiteIds.
invalid_order_number	400	The order number in the path is not a positive integer.	No – fix the path.
invalid_product_id	400	The productId path segment on GET /v1/products/{productId} does not match the SLO_/SLS_-prefixed shape.	No – fix the path.
invalid_service_type	400	GET /v1/products’s serviceType filter is not one of the values this API can order (STOCK or POD).	No – fix the parameter.
updated_since_not_supported	400	An updatedSince parameter was sent. Rejected rather than ignored, on purpose – see “No updatedSince / no change polling” above.	No – remove the parameter; there is no change-polling mechanism to switch to.
invalid_request	400	POST /v1/orders’s request body failed validation – malformed JSON, a missing or malformed field, an unknown key, or a body-level rule such as partnerLineId uniqueness or a misplaced shipTo – or GET /v1/orders/submissions’s status/limit filter is malformed. detail names the exact violation.	No – fix the request.
invalid_submission_id	400	The submissionId path segment on GET /v1/orders/submissions/{submissionId} is not a well-formed UUID.	No – fix the path.
invalid_quantity	400	The quantity on POST /v1/products/{productId}/quote is missing or not a positive integer.	No – fix the request body.
invalid_shipping_quote_request	400	POST /v1/shipping/quote’s body failed validation – malformed JSON, a missing or mistyped field, an unknown key at the top level or inside shipTo, or a weightOunces outside 0 < w <= 5000000. detail names the field.	No – fix the request body.
invalid_item_number	400	The itemNumber path segment on a proof route is not a positive integer. It is the line’s itemNumber from GET /v1/orders/{orderNumber}/items, never a Collaterate internal id.	No – fix the path.
invalid_token	401	The credential is missing, expired, or invalid.	No – mint a new token, retry once, then investigate the credential.
insufficient_scope	403	The token lacks the scope required for this operation.	No – mint a token with the required scope.
order_not_found	404	No such order, or one that exists outside your granted sites (see above).	No.
order_item_not_found	404	No line matching (orderNumber, itemNumber) resolves for you – absent, outside your granted sites, or hidden from the customer, identically.	No.
product_not_found	404	No such product, or one that exists but belongs to a site outside your granted sites (same rule as order_not_found).	No.
quote_product_not_found	404	The product resolved in our own catalog but Collaterate could not price it. Rare.	No.
template_not_found	404	GET /v1/products/{productId}/template found no Chili template for this product – not TEMPLATE-classified, TEMPLATE-classified with a legacy EDOC/CANVA vendor, or Chili-templated with no document configured. All three identically.	No.
submission_not_found	404	No submission exists with this id for your credential – whether it never existed or belongs to another partner, identically.	No.
ordering_not_provisioned	409	POST /v1/orders’s siteId has no ordering user configured. This is set up per (partner, site) by staff at onboarding; a partner cannot provision it themselves.	No – ask Partner Integrations to provision an ordering user for the site, then retry.
partner_order_id_reused	409	POST /v1/orders’s partnerOrderId was already used, with a request body that does not match this one. Resending the identical body under the same partnerOrderId is safe and returns the original submission (see the operation description); reusing it for a materially different order is rejected instead of silently creating a second order.	No – use a new partnerOrderId, or resend the exact original body to poll the existing submission.
proof_not_pending_review	409	A proof approve or decline was sent for a line whose proofStatus is not PENDING_REVIEW – no proof yet, already decided, or a state this API does not recognise. detail says which. On a RETRY of a decision that already succeeded, this is the expected answer and means success.	No – read the line’s current proofStatus from GET /v1/orders/{orderNumber}/items.
order_item_cancelled	409	A proof approve or decline was sent for a cancelled line. It will never be produced, so its proof cannot be decided.	No.
quote_invalid	422	Collaterate rejected the quote on business-validation grounds (e.g. quantity over the product’s configured maximum). detail carries Collaterate’s own validation message.	No – fix the request body (e.g. reduce quantity).
unknown_country_code	422	POST /v1/shipping/quote’s shipTo.country is not a country code Collaterate recognises.	No – send a code Collaterate carries (US, CA, MX, …).
unknown_state_code	422	POST /v1/shipping/quote’s shipTo.state is not a state or province of the country you sent. State codes are resolved WITHIN the country, since they are not unique across countries.	No – fix the state, or the country it belongs to.
shipping_quote_unavailable	422	POST /v1/shipping/quote produced no priced service at all for that destination and weight. detail carries Collaterate’s own reasons when it gave any – an invalid postal code for the country is the common one – and says so plainly when it did not.	No – fix the destination. An empty result is never returned as a 200.
denial_reason_not_available	422	POST .../proof/decline’s reason is well-formed but is not a denial reason this line’s proof offers – including a code that is valid on a different line, and UNKNOWN, which never is. detail lists what is valid here.	No – pick a code from GET .../proof/denial-reasons for this line.
rate_limit_exceeded	429	Rate limit or daily quota exceeded.	Yes – honor Retry-After.
internal_error	500	Unexpected server-side failure. Detail is always the fixed string below, never the underlying error.	No, or with caution – if persistent, contact Partner Integrations.
service_unavailable	503	Transient failure – typically the database path, but also a Lambda that crashed, timed out, or hit its own concurrency limit before any handler ran.	Yes, with backoff.

Three statuses are answered by the API gateway before your request reaches application code: 401 (authorizer denial), 429 (usage-plan throttle), and 503 (the Lambda integration itself failed). All three are configured to return this same document with the codes above, so one parser and one branch on code covers every error this API produces. The 403 on GET /v1/ping is the sole exception anywhere in the API – it comes from the edge firewall, which is not ours to shape, and carries no problem document.

object

type

required

Always the literal string about:blank today; reserved by RFC 9457 for future use.

string

Allowed value: about:blank

title

required

Short, human-readable summary of the HTTP status (e.g. “Not Found”).

string

status

required

The HTTP status code, repeated in the body for convenience.

integer

code

required

Stable, machine-readable error identifier. Safe to branch on. See the table above.

string

Allowed values: all_segments_visible_reset_not_acknowledged artwork_reservation_not_usable audit_unavailable auto_assigned_segments_present credit_account_not_found cursor_not_supported_with_search denial_reason_not_available division_code_conflict division_create_requires_address division_not_found division_not_on_site division_parent_invalid image_not_found insufficient_scope internal_error invalid_active invalid_adjustment_type invalid_cursor invalid_credit_account_id invalid_division_id invalid_image_id invalid_image_patch invalid_item_number invalid_order_number invalid_product_id invalid_product_patch invalid_quantity invalid_query invalid_request invalid_segment_ids invalid_segments_body invalid_service_type invalid_shipping_quote_request invalid_site_id invalid_submission_id invalid_token invalid_user_id invalid_variant_id invalid_variant_patch monolith_rejected monolith_target_missing null_not_supported order_item_cancelled order_item_not_found order_not_found ordering_not_provisioned parent_is_self parent_not_on_site partner_order_id_reused product_not_found product_write_partially_applied proof_not_pending_review quote_invalid quote_product_not_found rate_limit_exceeded search_not_available segment_not_on_site service_unavailable shipping_quote_unavailable site_id_required_for_search site_not_found sls_null_backfills_master submission_not_found template_not_found unknown_country_code unknown_query_parameter unknown_state_code unsupported_field_for_service_type updated_since_not_supported user_already_exists user_not_found variant_not_site_addressable

detail

required

Human-readable explanation. Do not parse this – it may be reworded without notice.

string

requestId

required

Echoes the request’s id. Include this when contacting Partner Integrations about a specific failed call – it resolves directly to one log entry.

string

Example

{
  "type": "about:blank",
  "title": "Unauthorized",
  "status": 401,
  "code": "invalid_token",
  "detail": "The credential presented with this request is missing, expired, or invalid.",
  "requestId": "8f3c1e2a-..."
}

403

The credential is valid but lacks the scope required for this operation (for example, a token minted without partner-api/orders:read). Not retryable as-is – request a token with the required scope. Not to be confused with an out-of-scope order, which is a 404 (see above), or with the edge firewall’s 403 on /ping, which carries no problem document at all.

Media typeapplication/problem+json

RFC 9457 application/problem+json body. code is the published, stable, machine-readable field to branch your integration logic on – detail is a human-readable string that may be reworded over time and must not be parsed.

This table is the whole published set: every code this API can return appears below, and nothing below is unreachable. test/docs/openapi-matches-reality.test.ts compares the enum to the codes the handlers actually construct, so a code added to one side and not the other fails the build rather than shipping.

Published code values:

code	HTTP status	Meaning	Retry?
invalid_cursor	400	The cursor query parameter could not be decoded.	No – restart pagination with no cursor. Do not resend the same value.
invalid_site_id	400	The siteId filter is not a positive integer, or it names a site outside your grant. detail says which.	No – fix the parameter against GET /v1/me’s grantedSiteIds.
invalid_order_number	400	The order number in the path is not a positive integer.	No – fix the path.
invalid_product_id	400	The productId path segment on GET /v1/products/{productId} does not match the SLO_/SLS_-prefixed shape.	No – fix the path.
invalid_service_type	400	GET /v1/products’s serviceType filter is not one of the values this API can order (STOCK or POD).	No – fix the parameter.
updated_since_not_supported	400	An updatedSince parameter was sent. Rejected rather than ignored, on purpose – see “No updatedSince / no change polling” above.	No – remove the parameter; there is no change-polling mechanism to switch to.
invalid_request	400	POST /v1/orders’s request body failed validation – malformed JSON, a missing or malformed field, an unknown key, or a body-level rule such as partnerLineId uniqueness or a misplaced shipTo – or GET /v1/orders/submissions’s status/limit filter is malformed. detail names the exact violation.	No – fix the request.
invalid_submission_id	400	The submissionId path segment on GET /v1/orders/submissions/{submissionId} is not a well-formed UUID.	No – fix the path.
invalid_quantity	400	The quantity on POST /v1/products/{productId}/quote is missing or not a positive integer.	No – fix the request body.
invalid_shipping_quote_request	400	POST /v1/shipping/quote’s body failed validation – malformed JSON, a missing or mistyped field, an unknown key at the top level or inside shipTo, or a weightOunces outside 0 < w <= 5000000. detail names the field.	No – fix the request body.
invalid_item_number	400	The itemNumber path segment on a proof route is not a positive integer. It is the line’s itemNumber from GET /v1/orders/{orderNumber}/items, never a Collaterate internal id.	No – fix the path.
invalid_token	401	The credential is missing, expired, or invalid.	No – mint a new token, retry once, then investigate the credential.
insufficient_scope	403	The token lacks the scope required for this operation.	No – mint a token with the required scope.
order_not_found	404	No such order, or one that exists outside your granted sites (see above).	No.
order_item_not_found	404	No line matching (orderNumber, itemNumber) resolves for you – absent, outside your granted sites, or hidden from the customer, identically.	No.
product_not_found	404	No such product, or one that exists but belongs to a site outside your granted sites (same rule as order_not_found).	No.
quote_product_not_found	404	The product resolved in our own catalog but Collaterate could not price it. Rare.	No.
template_not_found	404	GET /v1/products/{productId}/template found no Chili template for this product – not TEMPLATE-classified, TEMPLATE-classified with a legacy EDOC/CANVA vendor, or Chili-templated with no document configured. All three identically.	No.
submission_not_found	404	No submission exists with this id for your credential – whether it never existed or belongs to another partner, identically.	No.
ordering_not_provisioned	409	POST /v1/orders’s siteId has no ordering user configured. This is set up per (partner, site) by staff at onboarding; a partner cannot provision it themselves.	No – ask Partner Integrations to provision an ordering user for the site, then retry.
partner_order_id_reused	409	POST /v1/orders’s partnerOrderId was already used, with a request body that does not match this one. Resending the identical body under the same partnerOrderId is safe and returns the original submission (see the operation description); reusing it for a materially different order is rejected instead of silently creating a second order.	No – use a new partnerOrderId, or resend the exact original body to poll the existing submission.
proof_not_pending_review	409	A proof approve or decline was sent for a line whose proofStatus is not PENDING_REVIEW – no proof yet, already decided, or a state this API does not recognise. detail says which. On a RETRY of a decision that already succeeded, this is the expected answer and means success.	No – read the line’s current proofStatus from GET /v1/orders/{orderNumber}/items.
order_item_cancelled	409	A proof approve or decline was sent for a cancelled line. It will never be produced, so its proof cannot be decided.	No.
quote_invalid	422	Collaterate rejected the quote on business-validation grounds (e.g. quantity over the product’s configured maximum). detail carries Collaterate’s own validation message.	No – fix the request body (e.g. reduce quantity).
unknown_country_code	422	POST /v1/shipping/quote’s shipTo.country is not a country code Collaterate recognises.	No – send a code Collaterate carries (US, CA, MX, …).
unknown_state_code	422	POST /v1/shipping/quote’s shipTo.state is not a state or province of the country you sent. State codes are resolved WITHIN the country, since they are not unique across countries.	No – fix the state, or the country it belongs to.
shipping_quote_unavailable	422	POST /v1/shipping/quote produced no priced service at all for that destination and weight. detail carries Collaterate’s own reasons when it gave any – an invalid postal code for the country is the common one – and says so plainly when it did not.	No – fix the destination. An empty result is never returned as a 200.
denial_reason_not_available	422	POST .../proof/decline’s reason is well-formed but is not a denial reason this line’s proof offers – including a code that is valid on a different line, and UNKNOWN, which never is. detail lists what is valid here.	No – pick a code from GET .../proof/denial-reasons for this line.
rate_limit_exceeded	429	Rate limit or daily quota exceeded.	Yes – honor Retry-After.
internal_error	500	Unexpected server-side failure. Detail is always the fixed string below, never the underlying error.	No, or with caution – if persistent, contact Partner Integrations.
service_unavailable	503	Transient failure – typically the database path, but also a Lambda that crashed, timed out, or hit its own concurrency limit before any handler ran.	Yes, with backoff.

Three statuses are answered by the API gateway before your request reaches application code: 401 (authorizer denial), 429 (usage-plan throttle), and 503 (the Lambda integration itself failed). All three are configured to return this same document with the codes above, so one parser and one branch on code covers every error this API produces. The 403 on GET /v1/ping is the sole exception anywhere in the API – it comes from the edge firewall, which is not ours to shape, and carries no problem document.

object

type

required

Always the literal string about:blank today; reserved by RFC 9457 for future use.

string

Allowed value: about:blank

title

required

Short, human-readable summary of the HTTP status (e.g. “Not Found”).

string

status

required

The HTTP status code, repeated in the body for convenience.

integer

code

required

Stable, machine-readable error identifier. Safe to branch on. See the table above.

string

Allowed values: all_segments_visible_reset_not_acknowledged artwork_reservation_not_usable audit_unavailable auto_assigned_segments_present credit_account_not_found cursor_not_supported_with_search denial_reason_not_available division_code_conflict division_create_requires_address division_not_found division_not_on_site division_parent_invalid image_not_found insufficient_scope internal_error invalid_active invalid_adjustment_type invalid_cursor invalid_credit_account_id invalid_division_id invalid_image_id invalid_image_patch invalid_item_number invalid_order_number invalid_product_id invalid_product_patch invalid_quantity invalid_query invalid_request invalid_segment_ids invalid_segments_body invalid_service_type invalid_shipping_quote_request invalid_site_id invalid_submission_id invalid_token invalid_user_id invalid_variant_id invalid_variant_patch monolith_rejected monolith_target_missing null_not_supported order_item_cancelled order_item_not_found order_not_found ordering_not_provisioned parent_is_self parent_not_on_site partner_order_id_reused product_not_found product_write_partially_applied proof_not_pending_review quote_invalid quote_product_not_found rate_limit_exceeded search_not_available segment_not_on_site service_unavailable shipping_quote_unavailable site_id_required_for_search site_not_found sls_null_backfills_master submission_not_found template_not_found unknown_country_code unknown_query_parameter unknown_state_code unsupported_field_for_service_type updated_since_not_supported user_already_exists user_not_found variant_not_site_addressable

detail

required

Human-readable explanation. Do not parse this – it may be reworded without notice.

string

requestId

required

Echoes the request’s id. Include this when contacting Partner Integrations about a specific failed call – it resolves directly to one log entry.

string

Example

{
  "type": "about:blank",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "This request requires the \"partner-api/orders:read\" scope.",
  "requestId": "8f3c1e2a-..."
}

404

No such order, OR an order that exists but is outside your granted sites. These two cases are indistinguishable on purpose. Not retryable as-is.

On the shipments and items sub-resources this status is about the ORDER, never the collection: an order that resolves for you but has no shipments (or no visible items) yet returns 200 with an empty array. A 404 from those endpoints means the order number itself does not resolve for you.

Media typeapplication/problem+json

RFC 9457 application/problem+json body. code is the published, stable, machine-readable field to branch your integration logic on – detail is a human-readable string that may be reworded over time and must not be parsed.

This table is the whole published set: every code this API can return appears below, and nothing below is unreachable. test/docs/openapi-matches-reality.test.ts compares the enum to the codes the handlers actually construct, so a code added to one side and not the other fails the build rather than shipping.

Published code values:

code	HTTP status	Meaning	Retry?
invalid_cursor	400	The cursor query parameter could not be decoded.	No – restart pagination with no cursor. Do not resend the same value.
invalid_site_id	400	The siteId filter is not a positive integer, or it names a site outside your grant. detail says which.	No – fix the parameter against GET /v1/me’s grantedSiteIds.
invalid_order_number	400	The order number in the path is not a positive integer.	No – fix the path.
invalid_product_id	400	The productId path segment on GET /v1/products/{productId} does not match the SLO_/SLS_-prefixed shape.	No – fix the path.
invalid_service_type	400	GET /v1/products’s serviceType filter is not one of the values this API can order (STOCK or POD).	No – fix the parameter.
updated_since_not_supported	400	An updatedSince parameter was sent. Rejected rather than ignored, on purpose – see “No updatedSince / no change polling” above.	No – remove the parameter; there is no change-polling mechanism to switch to.
invalid_request	400	POST /v1/orders’s request body failed validation – malformed JSON, a missing or malformed field, an unknown key, or a body-level rule such as partnerLineId uniqueness or a misplaced shipTo – or GET /v1/orders/submissions’s status/limit filter is malformed. detail names the exact violation.	No – fix the request.
invalid_submission_id	400	The submissionId path segment on GET /v1/orders/submissions/{submissionId} is not a well-formed UUID.	No – fix the path.
invalid_quantity	400	The quantity on POST /v1/products/{productId}/quote is missing or not a positive integer.	No – fix the request body.
invalid_shipping_quote_request	400	POST /v1/shipping/quote’s body failed validation – malformed JSON, a missing or mistyped field, an unknown key at the top level or inside shipTo, or a weightOunces outside 0 < w <= 5000000. detail names the field.	No – fix the request body.
invalid_item_number	400	The itemNumber path segment on a proof route is not a positive integer. It is the line’s itemNumber from GET /v1/orders/{orderNumber}/items, never a Collaterate internal id.	No – fix the path.
invalid_token	401	The credential is missing, expired, or invalid.	No – mint a new token, retry once, then investigate the credential.
insufficient_scope	403	The token lacks the scope required for this operation.	No – mint a token with the required scope.
order_not_found	404	No such order, or one that exists outside your granted sites (see above).	No.
order_item_not_found	404	No line matching (orderNumber, itemNumber) resolves for you – absent, outside your granted sites, or hidden from the customer, identically.	No.
product_not_found	404	No such product, or one that exists but belongs to a site outside your granted sites (same rule as order_not_found).	No.
quote_product_not_found	404	The product resolved in our own catalog but Collaterate could not price it. Rare.	No.
template_not_found	404	GET /v1/products/{productId}/template found no Chili template for this product – not TEMPLATE-classified, TEMPLATE-classified with a legacy EDOC/CANVA vendor, or Chili-templated with no document configured. All three identically.	No.
submission_not_found	404	No submission exists with this id for your credential – whether it never existed or belongs to another partner, identically.	No.
ordering_not_provisioned	409	POST /v1/orders’s siteId has no ordering user configured. This is set up per (partner, site) by staff at onboarding; a partner cannot provision it themselves.	No – ask Partner Integrations to provision an ordering user for the site, then retry.
partner_order_id_reused	409	POST /v1/orders’s partnerOrderId was already used, with a request body that does not match this one. Resending the identical body under the same partnerOrderId is safe and returns the original submission (see the operation description); reusing it for a materially different order is rejected instead of silently creating a second order.	No – use a new partnerOrderId, or resend the exact original body to poll the existing submission.
proof_not_pending_review	409	A proof approve or decline was sent for a line whose proofStatus is not PENDING_REVIEW – no proof yet, already decided, or a state this API does not recognise. detail says which. On a RETRY of a decision that already succeeded, this is the expected answer and means success.	No – read the line’s current proofStatus from GET /v1/orders/{orderNumber}/items.
order_item_cancelled	409	A proof approve or decline was sent for a cancelled line. It will never be produced, so its proof cannot be decided.	No.
quote_invalid	422	Collaterate rejected the quote on business-validation grounds (e.g. quantity over the product’s configured maximum). detail carries Collaterate’s own validation message.	No – fix the request body (e.g. reduce quantity).
unknown_country_code	422	POST /v1/shipping/quote’s shipTo.country is not a country code Collaterate recognises.	No – send a code Collaterate carries (US, CA, MX, …).
unknown_state_code	422	POST /v1/shipping/quote’s shipTo.state is not a state or province of the country you sent. State codes are resolved WITHIN the country, since they are not unique across countries.	No – fix the state, or the country it belongs to.
shipping_quote_unavailable	422	POST /v1/shipping/quote produced no priced service at all for that destination and weight. detail carries Collaterate’s own reasons when it gave any – an invalid postal code for the country is the common one – and says so plainly when it did not.	No – fix the destination. An empty result is never returned as a 200.
denial_reason_not_available	422	POST .../proof/decline’s reason is well-formed but is not a denial reason this line’s proof offers – including a code that is valid on a different line, and UNKNOWN, which never is. detail lists what is valid here.	No – pick a code from GET .../proof/denial-reasons for this line.
rate_limit_exceeded	429	Rate limit or daily quota exceeded.	Yes – honor Retry-After.
internal_error	500	Unexpected server-side failure. Detail is always the fixed string below, never the underlying error.	No, or with caution – if persistent, contact Partner Integrations.
service_unavailable	503	Transient failure – typically the database path, but also a Lambda that crashed, timed out, or hit its own concurrency limit before any handler ran.	Yes, with backoff.

Three statuses are answered by the API gateway before your request reaches application code: 401 (authorizer denial), 429 (usage-plan throttle), and 503 (the Lambda integration itself failed). All three are configured to return this same document with the codes above, so one parser and one branch on code covers every error this API produces. The 403 on GET /v1/ping is the sole exception anywhere in the API – it comes from the edge firewall, which is not ours to shape, and carries no problem document.

object

type

required

Always the literal string about:blank today; reserved by RFC 9457 for future use.

string

Allowed value: about:blank

title

required

Short, human-readable summary of the HTTP status (e.g. “Not Found”).

string

status

required

The HTTP status code, repeated in the body for convenience.

integer

code

required

Stable, machine-readable error identifier. Safe to branch on. See the table above.

string

Allowed values: all_segments_visible_reset_not_acknowledged artwork_reservation_not_usable audit_unavailable auto_assigned_segments_present credit_account_not_found cursor_not_supported_with_search denial_reason_not_available division_code_conflict division_create_requires_address division_not_found division_not_on_site division_parent_invalid image_not_found insufficient_scope internal_error invalid_active invalid_adjustment_type invalid_cursor invalid_credit_account_id invalid_division_id invalid_image_id invalid_image_patch invalid_item_number invalid_order_number invalid_product_id invalid_product_patch invalid_quantity invalid_query invalid_request invalid_segment_ids invalid_segments_body invalid_service_type invalid_shipping_quote_request invalid_site_id invalid_submission_id invalid_token invalid_user_id invalid_variant_id invalid_variant_patch monolith_rejected monolith_target_missing null_not_supported order_item_cancelled order_item_not_found order_not_found ordering_not_provisioned parent_is_self parent_not_on_site partner_order_id_reused product_not_found product_write_partially_applied proof_not_pending_review quote_invalid quote_product_not_found rate_limit_exceeded search_not_available segment_not_on_site service_unavailable shipping_quote_unavailable site_id_required_for_search site_not_found sls_null_backfills_master submission_not_found template_not_found unknown_country_code unknown_query_parameter unknown_state_code unsupported_field_for_service_type updated_since_not_supported user_already_exists user_not_found variant_not_site_addressable

detail

required

Human-readable explanation. Do not parse this – it may be reworded without notice.

string

requestId

required

Echoes the request’s id. Include this when contacting Partner Integrations about a specific failed call – it resolves directly to one log entry.

string

Example

{
  "type": "about:blank",
  "title": "Not Found",
  "status": 404,
  "code": "order_not_found",
  "detail": "No order was found matching the request.",
  "requestId": "8f3c1e2a-..."
}

429

Your rate limit or daily quota was exceeded. Retryable – honor the Retry-After header (seconds) before your next attempt.

Like the 401, this comes from the gateway’s usage plan rather than from application code, and is configured to carry the same problem document as every other error so a single parser covers the whole API.

Media typeapplication/problem+json

RFC 9457 application/problem+json body. code is the published, stable, machine-readable field to branch your integration logic on – detail is a human-readable string that may be reworded over time and must not be parsed.

This table is the whole published set: every code this API can return appears below, and nothing below is unreachable. test/docs/openapi-matches-reality.test.ts compares the enum to the codes the handlers actually construct, so a code added to one side and not the other fails the build rather than shipping.

Published code values:

code	HTTP status	Meaning	Retry?
invalid_cursor	400	The cursor query parameter could not be decoded.	No – restart pagination with no cursor. Do not resend the same value.
invalid_site_id	400	The siteId filter is not a positive integer, or it names a site outside your grant. detail says which.	No – fix the parameter against GET /v1/me’s grantedSiteIds.
invalid_order_number	400	The order number in the path is not a positive integer.	No – fix the path.
invalid_product_id	400	The productId path segment on GET /v1/products/{productId} does not match the SLO_/SLS_-prefixed shape.	No – fix the path.
invalid_service_type	400	GET /v1/products’s serviceType filter is not one of the values this API can order (STOCK or POD).	No – fix the parameter.
updated_since_not_supported	400	An updatedSince parameter was sent. Rejected rather than ignored, on purpose – see “No updatedSince / no change polling” above.	No – remove the parameter; there is no change-polling mechanism to switch to.
invalid_request	400	POST /v1/orders’s request body failed validation – malformed JSON, a missing or malformed field, an unknown key, or a body-level rule such as partnerLineId uniqueness or a misplaced shipTo – or GET /v1/orders/submissions’s status/limit filter is malformed. detail names the exact violation.	No – fix the request.
invalid_submission_id	400	The submissionId path segment on GET /v1/orders/submissions/{submissionId} is not a well-formed UUID.	No – fix the path.
invalid_quantity	400	The quantity on POST /v1/products/{productId}/quote is missing or not a positive integer.	No – fix the request body.
invalid_shipping_quote_request	400	POST /v1/shipping/quote’s body failed validation – malformed JSON, a missing or mistyped field, an unknown key at the top level or inside shipTo, or a weightOunces outside 0 < w <= 5000000. detail names the field.	No – fix the request body.
invalid_item_number	400	The itemNumber path segment on a proof route is not a positive integer. It is the line’s itemNumber from GET /v1/orders/{orderNumber}/items, never a Collaterate internal id.	No – fix the path.
invalid_token	401	The credential is missing, expired, or invalid.	No – mint a new token, retry once, then investigate the credential.
insufficient_scope	403	The token lacks the scope required for this operation.	No – mint a token with the required scope.
order_not_found	404	No such order, or one that exists outside your granted sites (see above).	No.
order_item_not_found	404	No line matching (orderNumber, itemNumber) resolves for you – absent, outside your granted sites, or hidden from the customer, identically.	No.
product_not_found	404	No such product, or one that exists but belongs to a site outside your granted sites (same rule as order_not_found).	No.
quote_product_not_found	404	The product resolved in our own catalog but Collaterate could not price it. Rare.	No.
template_not_found	404	GET /v1/products/{productId}/template found no Chili template for this product – not TEMPLATE-classified, TEMPLATE-classified with a legacy EDOC/CANVA vendor, or Chili-templated with no document configured. All three identically.	No.
submission_not_found	404	No submission exists with this id for your credential – whether it never existed or belongs to another partner, identically.	No.
ordering_not_provisioned	409	POST /v1/orders’s siteId has no ordering user configured. This is set up per (partner, site) by staff at onboarding; a partner cannot provision it themselves.	No – ask Partner Integrations to provision an ordering user for the site, then retry.
partner_order_id_reused	409	POST /v1/orders’s partnerOrderId was already used, with a request body that does not match this one. Resending the identical body under the same partnerOrderId is safe and returns the original submission (see the operation description); reusing it for a materially different order is rejected instead of silently creating a second order.	No – use a new partnerOrderId, or resend the exact original body to poll the existing submission.
proof_not_pending_review	409	A proof approve or decline was sent for a line whose proofStatus is not PENDING_REVIEW – no proof yet, already decided, or a state this API does not recognise. detail says which. On a RETRY of a decision that already succeeded, this is the expected answer and means success.	No – read the line’s current proofStatus from GET /v1/orders/{orderNumber}/items.
order_item_cancelled	409	A proof approve or decline was sent for a cancelled line. It will never be produced, so its proof cannot be decided.	No.
quote_invalid	422	Collaterate rejected the quote on business-validation grounds (e.g. quantity over the product’s configured maximum). detail carries Collaterate’s own validation message.	No – fix the request body (e.g. reduce quantity).
unknown_country_code	422	POST /v1/shipping/quote’s shipTo.country is not a country code Collaterate recognises.	No – send a code Collaterate carries (US, CA, MX, …).
unknown_state_code	422	POST /v1/shipping/quote’s shipTo.state is not a state or province of the country you sent. State codes are resolved WITHIN the country, since they are not unique across countries.	No – fix the state, or the country it belongs to.
shipping_quote_unavailable	422	POST /v1/shipping/quote produced no priced service at all for that destination and weight. detail carries Collaterate’s own reasons when it gave any – an invalid postal code for the country is the common one – and says so plainly when it did not.	No – fix the destination. An empty result is never returned as a 200.
denial_reason_not_available	422	POST .../proof/decline’s reason is well-formed but is not a denial reason this line’s proof offers – including a code that is valid on a different line, and UNKNOWN, which never is. detail lists what is valid here.	No – pick a code from GET .../proof/denial-reasons for this line.
rate_limit_exceeded	429	Rate limit or daily quota exceeded.	Yes – honor Retry-After.
internal_error	500	Unexpected server-side failure. Detail is always the fixed string below, never the underlying error.	No, or with caution – if persistent, contact Partner Integrations.
service_unavailable	503	Transient failure – typically the database path, but also a Lambda that crashed, timed out, or hit its own concurrency limit before any handler ran.	Yes, with backoff.

Three statuses are answered by the API gateway before your request reaches application code: 401 (authorizer denial), 429 (usage-plan throttle), and 503 (the Lambda integration itself failed). All three are configured to return this same document with the codes above, so one parser and one branch on code covers every error this API produces. The 403 on GET /v1/ping is the sole exception anywhere in the API – it comes from the edge firewall, which is not ours to shape, and carries no problem document.

object

type

required

Always the literal string about:blank today; reserved by RFC 9457 for future use.

string

Allowed value: about:blank

title

required

Short, human-readable summary of the HTTP status (e.g. “Not Found”).

string

status

required

The HTTP status code, repeated in the body for convenience.

integer

code

required

Stable, machine-readable error identifier. Safe to branch on. See the table above.

string

Allowed values: all_segments_visible_reset_not_acknowledged artwork_reservation_not_usable audit_unavailable auto_assigned_segments_present credit_account_not_found cursor_not_supported_with_search denial_reason_not_available division_code_conflict division_create_requires_address division_not_found division_not_on_site division_parent_invalid image_not_found insufficient_scope internal_error invalid_active invalid_adjustment_type invalid_cursor invalid_credit_account_id invalid_division_id invalid_image_id invalid_image_patch invalid_item_number invalid_order_number invalid_product_id invalid_product_patch invalid_quantity invalid_query invalid_request invalid_segment_ids invalid_segments_body invalid_service_type invalid_shipping_quote_request invalid_site_id invalid_submission_id invalid_token invalid_user_id invalid_variant_id invalid_variant_patch monolith_rejected monolith_target_missing null_not_supported order_item_cancelled order_item_not_found order_not_found ordering_not_provisioned parent_is_self parent_not_on_site partner_order_id_reused product_not_found product_write_partially_applied proof_not_pending_review quote_invalid quote_product_not_found rate_limit_exceeded search_not_available segment_not_on_site service_unavailable shipping_quote_unavailable site_id_required_for_search site_not_found sls_null_backfills_master submission_not_found template_not_found unknown_country_code unknown_query_parameter unknown_state_code unsupported_field_for_service_type updated_since_not_supported user_already_exists user_not_found variant_not_site_addressable

detail

required

Human-readable explanation. Do not parse this – it may be reworded without notice.

string

requestId

required

Echoes the request’s id. Include this when contacting Partner Integrations about a specific failed call – it resolves directly to one log entry.

string

Example

{
  "type": "about:blank",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limit_exceeded",
  "detail": "The request rate limit has been exceeded. Retry after the indicated delay.",
  "requestId": "8f3c1e2a-..."
}

Headers

Retry-After

integer

Seconds to wait before retrying.

500

An unexpected server-side failure. detail is always the fixed string below and never the underlying error – a database message quoted back to a partner is a disclosure, so nothing is interpolated into it. The requestId resolves to the log entry that does carry the cause; send it to Partner Integrations rather than guessing.

Media typeapplication/problem+json

RFC 9457 application/problem+json body. code is the published, stable, machine-readable field to branch your integration logic on – detail is a human-readable string that may be reworded over time and must not be parsed.

This table is the whole published set: every code this API can return appears below, and nothing below is unreachable. test/docs/openapi-matches-reality.test.ts compares the enum to the codes the handlers actually construct, so a code added to one side and not the other fails the build rather than shipping.

Published code values:

code	HTTP status	Meaning	Retry?
invalid_cursor	400	The cursor query parameter could not be decoded.	No – restart pagination with no cursor. Do not resend the same value.
invalid_site_id	400	The siteId filter is not a positive integer, or it names a site outside your grant. detail says which.	No – fix the parameter against GET /v1/me’s grantedSiteIds.
invalid_order_number	400	The order number in the path is not a positive integer.	No – fix the path.
invalid_product_id	400	The productId path segment on GET /v1/products/{productId} does not match the SLO_/SLS_-prefixed shape.	No – fix the path.
invalid_service_type	400	GET /v1/products’s serviceType filter is not one of the values this API can order (STOCK or POD).	No – fix the parameter.
updated_since_not_supported	400	An updatedSince parameter was sent. Rejected rather than ignored, on purpose – see “No updatedSince / no change polling” above.	No – remove the parameter; there is no change-polling mechanism to switch to.
invalid_request	400	POST /v1/orders’s request body failed validation – malformed JSON, a missing or malformed field, an unknown key, or a body-level rule such as partnerLineId uniqueness or a misplaced shipTo – or GET /v1/orders/submissions’s status/limit filter is malformed. detail names the exact violation.	No – fix the request.
invalid_submission_id	400	The submissionId path segment on GET /v1/orders/submissions/{submissionId} is not a well-formed UUID.	No – fix the path.
invalid_quantity	400	The quantity on POST /v1/products/{productId}/quote is missing or not a positive integer.	No – fix the request body.
invalid_shipping_quote_request	400	POST /v1/shipping/quote’s body failed validation – malformed JSON, a missing or mistyped field, an unknown key at the top level or inside shipTo, or a weightOunces outside 0 < w <= 5000000. detail names the field.	No – fix the request body.
invalid_item_number	400	The itemNumber path segment on a proof route is not a positive integer. It is the line’s itemNumber from GET /v1/orders/{orderNumber}/items, never a Collaterate internal id.	No – fix the path.
invalid_token	401	The credential is missing, expired, or invalid.	No – mint a new token, retry once, then investigate the credential.
insufficient_scope	403	The token lacks the scope required for this operation.	No – mint a token with the required scope.
order_not_found	404	No such order, or one that exists outside your granted sites (see above).	No.
order_item_not_found	404	No line matching (orderNumber, itemNumber) resolves for you – absent, outside your granted sites, or hidden from the customer, identically.	No.
product_not_found	404	No such product, or one that exists but belongs to a site outside your granted sites (same rule as order_not_found).	No.
quote_product_not_found	404	The product resolved in our own catalog but Collaterate could not price it. Rare.	No.
template_not_found	404	GET /v1/products/{productId}/template found no Chili template for this product – not TEMPLATE-classified, TEMPLATE-classified with a legacy EDOC/CANVA vendor, or Chili-templated with no document configured. All three identically.	No.
submission_not_found	404	No submission exists with this id for your credential – whether it never existed or belongs to another partner, identically.	No.
ordering_not_provisioned	409	POST /v1/orders’s siteId has no ordering user configured. This is set up per (partner, site) by staff at onboarding; a partner cannot provision it themselves.	No – ask Partner Integrations to provision an ordering user for the site, then retry.
partner_order_id_reused	409	POST /v1/orders’s partnerOrderId was already used, with a request body that does not match this one. Resending the identical body under the same partnerOrderId is safe and returns the original submission (see the operation description); reusing it for a materially different order is rejected instead of silently creating a second order.	No – use a new partnerOrderId, or resend the exact original body to poll the existing submission.
proof_not_pending_review	409	A proof approve or decline was sent for a line whose proofStatus is not PENDING_REVIEW – no proof yet, already decided, or a state this API does not recognise. detail says which. On a RETRY of a decision that already succeeded, this is the expected answer and means success.	No – read the line’s current proofStatus from GET /v1/orders/{orderNumber}/items.
order_item_cancelled	409	A proof approve or decline was sent for a cancelled line. It will never be produced, so its proof cannot be decided.	No.
quote_invalid	422	Collaterate rejected the quote on business-validation grounds (e.g. quantity over the product’s configured maximum). detail carries Collaterate’s own validation message.	No – fix the request body (e.g. reduce quantity).
unknown_country_code	422	POST /v1/shipping/quote’s shipTo.country is not a country code Collaterate recognises.	No – send a code Collaterate carries (US, CA, MX, …).
unknown_state_code	422	POST /v1/shipping/quote’s shipTo.state is not a state or province of the country you sent. State codes are resolved WITHIN the country, since they are not unique across countries.	No – fix the state, or the country it belongs to.
shipping_quote_unavailable	422	POST /v1/shipping/quote produced no priced service at all for that destination and weight. detail carries Collaterate’s own reasons when it gave any – an invalid postal code for the country is the common one – and says so plainly when it did not.	No – fix the destination. An empty result is never returned as a 200.
denial_reason_not_available	422	POST .../proof/decline’s reason is well-formed but is not a denial reason this line’s proof offers – including a code that is valid on a different line, and UNKNOWN, which never is. detail lists what is valid here.	No – pick a code from GET .../proof/denial-reasons for this line.
rate_limit_exceeded	429	Rate limit or daily quota exceeded.	Yes – honor Retry-After.
internal_error	500	Unexpected server-side failure. Detail is always the fixed string below, never the underlying error.	No, or with caution – if persistent, contact Partner Integrations.
service_unavailable	503	Transient failure – typically the database path, but also a Lambda that crashed, timed out, or hit its own concurrency limit before any handler ran.	Yes, with backoff.

Three statuses are answered by the API gateway before your request reaches application code: 401 (authorizer denial), 429 (usage-plan throttle), and 503 (the Lambda integration itself failed). All three are configured to return this same document with the codes above, so one parser and one branch on code covers every error this API produces. The 403 on GET /v1/ping is the sole exception anywhere in the API – it comes from the edge firewall, which is not ours to shape, and carries no problem document.

object

type

required

Always the literal string about:blank today; reserved by RFC 9457 for future use.

string

Allowed value: about:blank

title

required

Short, human-readable summary of the HTTP status (e.g. “Not Found”).

string

status

required

The HTTP status code, repeated in the body for convenience.

integer

code

required

Stable, machine-readable error identifier. Safe to branch on. See the table above.

string

Allowed values: all_segments_visible_reset_not_acknowledged artwork_reservation_not_usable audit_unavailable auto_assigned_segments_present credit_account_not_found cursor_not_supported_with_search denial_reason_not_available division_code_conflict division_create_requires_address division_not_found division_not_on_site division_parent_invalid image_not_found insufficient_scope internal_error invalid_active invalid_adjustment_type invalid_cursor invalid_credit_account_id invalid_division_id invalid_image_id invalid_image_patch invalid_item_number invalid_order_number invalid_product_id invalid_product_patch invalid_quantity invalid_query invalid_request invalid_segment_ids invalid_segments_body invalid_service_type invalid_shipping_quote_request invalid_site_id invalid_submission_id invalid_token invalid_user_id invalid_variant_id invalid_variant_patch monolith_rejected monolith_target_missing null_not_supported order_item_cancelled order_item_not_found order_not_found ordering_not_provisioned parent_is_self parent_not_on_site partner_order_id_reused product_not_found product_write_partially_applied proof_not_pending_review quote_invalid quote_product_not_found rate_limit_exceeded search_not_available segment_not_on_site service_unavailable shipping_quote_unavailable site_id_required_for_search site_not_found sls_null_backfills_master submission_not_found template_not_found unknown_country_code unknown_query_parameter unknown_state_code unsupported_field_for_service_type updated_since_not_supported user_already_exists user_not_found variant_not_site_addressable

detail

required

Human-readable explanation. Do not parse this – it may be reworded without notice.

string

requestId

required

Echoes the request’s id. Include this when contacting Partner Integrations about a specific failed call – it resolves directly to one log entry.

string

Example

{
  "type": "about:blank",
  "title": "Internal Server Error",
  "status": 500,
  "code": "internal_error",
  "detail": "An unexpected error occurred.",
  "requestId": "8f3c1e2a-..."
}

503

Transient failure in the service or the database it reads from (for example, the Aurora reader could not be reached in time), or the request never reached application code at all because the Lambda behind it crashed, timed out, or hit its own concurrency limit. Retryable, with backoff.

Media typeapplication/problem+json

RFC 9457 application/problem+json body. code is the published, stable, machine-readable field to branch your integration logic on – detail is a human-readable string that may be reworded over time and must not be parsed.

This table is the whole published set: every code this API can return appears below, and nothing below is unreachable. test/docs/openapi-matches-reality.test.ts compares the enum to the codes the handlers actually construct, so a code added to one side and not the other fails the build rather than shipping.

Published code values:

code	HTTP status	Meaning	Retry?
invalid_cursor	400	The cursor query parameter could not be decoded.	No – restart pagination with no cursor. Do not resend the same value.
invalid_site_id	400	The siteId filter is not a positive integer, or it names a site outside your grant. detail says which.	No – fix the parameter against GET /v1/me’s grantedSiteIds.
invalid_order_number	400	The order number in the path is not a positive integer.	No – fix the path.
invalid_product_id	400	The productId path segment on GET /v1/products/{productId} does not match the SLO_/SLS_-prefixed shape.	No – fix the path.
invalid_service_type	400	GET /v1/products’s serviceType filter is not one of the values this API can order (STOCK or POD).	No – fix the parameter.
updated_since_not_supported	400	An updatedSince parameter was sent. Rejected rather than ignored, on purpose – see “No updatedSince / no change polling” above.	No – remove the parameter; there is no change-polling mechanism to switch to.
invalid_request	400	POST /v1/orders’s request body failed validation – malformed JSON, a missing or malformed field, an unknown key, or a body-level rule such as partnerLineId uniqueness or a misplaced shipTo – or GET /v1/orders/submissions’s status/limit filter is malformed. detail names the exact violation.	No – fix the request.
invalid_submission_id	400	The submissionId path segment on GET /v1/orders/submissions/{submissionId} is not a well-formed UUID.	No – fix the path.
invalid_quantity	400	The quantity on POST /v1/products/{productId}/quote is missing or not a positive integer.	No – fix the request body.
invalid_shipping_quote_request	400	POST /v1/shipping/quote’s body failed validation – malformed JSON, a missing or mistyped field, an unknown key at the top level or inside shipTo, or a weightOunces outside 0 < w <= 5000000. detail names the field.	No – fix the request body.
invalid_item_number	400	The itemNumber path segment on a proof route is not a positive integer. It is the line’s itemNumber from GET /v1/orders/{orderNumber}/items, never a Collaterate internal id.	No – fix the path.
invalid_token	401	The credential is missing, expired, or invalid.	No – mint a new token, retry once, then investigate the credential.
insufficient_scope	403	The token lacks the scope required for this operation.	No – mint a token with the required scope.
order_not_found	404	No such order, or one that exists outside your granted sites (see above).	No.
order_item_not_found	404	No line matching (orderNumber, itemNumber) resolves for you – absent, outside your granted sites, or hidden from the customer, identically.	No.
product_not_found	404	No such product, or one that exists but belongs to a site outside your granted sites (same rule as order_not_found).	No.
quote_product_not_found	404	The product resolved in our own catalog but Collaterate could not price it. Rare.	No.
template_not_found	404	GET /v1/products/{productId}/template found no Chili template for this product – not TEMPLATE-classified, TEMPLATE-classified with a legacy EDOC/CANVA vendor, or Chili-templated with no document configured. All three identically.	No.
submission_not_found	404	No submission exists with this id for your credential – whether it never existed or belongs to another partner, identically.	No.
ordering_not_provisioned	409	POST /v1/orders’s siteId has no ordering user configured. This is set up per (partner, site) by staff at onboarding; a partner cannot provision it themselves.	No – ask Partner Integrations to provision an ordering user for the site, then retry.
partner_order_id_reused	409	POST /v1/orders’s partnerOrderId was already used, with a request body that does not match this one. Resending the identical body under the same partnerOrderId is safe and returns the original submission (see the operation description); reusing it for a materially different order is rejected instead of silently creating a second order.	No – use a new partnerOrderId, or resend the exact original body to poll the existing submission.
proof_not_pending_review	409	A proof approve or decline was sent for a line whose proofStatus is not PENDING_REVIEW – no proof yet, already decided, or a state this API does not recognise. detail says which. On a RETRY of a decision that already succeeded, this is the expected answer and means success.	No – read the line’s current proofStatus from GET /v1/orders/{orderNumber}/items.
order_item_cancelled	409	A proof approve or decline was sent for a cancelled line. It will never be produced, so its proof cannot be decided.	No.
quote_invalid	422	Collaterate rejected the quote on business-validation grounds (e.g. quantity over the product’s configured maximum). detail carries Collaterate’s own validation message.	No – fix the request body (e.g. reduce quantity).
unknown_country_code	422	POST /v1/shipping/quote’s shipTo.country is not a country code Collaterate recognises.	No – send a code Collaterate carries (US, CA, MX, …).
unknown_state_code	422	POST /v1/shipping/quote’s shipTo.state is not a state or province of the country you sent. State codes are resolved WITHIN the country, since they are not unique across countries.	No – fix the state, or the country it belongs to.
shipping_quote_unavailable	422	POST /v1/shipping/quote produced no priced service at all for that destination and weight. detail carries Collaterate’s own reasons when it gave any – an invalid postal code for the country is the common one – and says so plainly when it did not.	No – fix the destination. An empty result is never returned as a 200.
denial_reason_not_available	422	POST .../proof/decline’s reason is well-formed but is not a denial reason this line’s proof offers – including a code that is valid on a different line, and UNKNOWN, which never is. detail lists what is valid here.	No – pick a code from GET .../proof/denial-reasons for this line.
rate_limit_exceeded	429	Rate limit or daily quota exceeded.	Yes – honor Retry-After.
internal_error	500	Unexpected server-side failure. Detail is always the fixed string below, never the underlying error.	No, or with caution – if persistent, contact Partner Integrations.
service_unavailable	503	Transient failure – typically the database path, but also a Lambda that crashed, timed out, or hit its own concurrency limit before any handler ran.	Yes, with backoff.

Three statuses are answered by the API gateway before your request reaches application code: 401 (authorizer denial), 429 (usage-plan throttle), and 503 (the Lambda integration itself failed). All three are configured to return this same document with the codes above, so one parser and one branch on code covers every error this API produces. The 403 on GET /v1/ping is the sole exception anywhere in the API – it comes from the edge firewall, which is not ours to shape, and carries no problem document.

object

type

required

Always the literal string about:blank today; reserved by RFC 9457 for future use.

string

Allowed value: about:blank

title

required

Short, human-readable summary of the HTTP status (e.g. “Not Found”).

string

status

required

The HTTP status code, repeated in the body for convenience.

integer

code

required

Stable, machine-readable error identifier. Safe to branch on. See the table above.

string

Allowed values: all_segments_visible_reset_not_acknowledged artwork_reservation_not_usable audit_unavailable auto_assigned_segments_present credit_account_not_found cursor_not_supported_with_search denial_reason_not_available division_code_conflict division_create_requires_address division_not_found division_not_on_site division_parent_invalid image_not_found insufficient_scope internal_error invalid_active invalid_adjustment_type invalid_cursor invalid_credit_account_id invalid_division_id invalid_image_id invalid_image_patch invalid_item_number invalid_order_number invalid_product_id invalid_product_patch invalid_quantity invalid_query invalid_request invalid_segment_ids invalid_segments_body invalid_service_type invalid_shipping_quote_request invalid_site_id invalid_submission_id invalid_token invalid_user_id invalid_variant_id invalid_variant_patch monolith_rejected monolith_target_missing null_not_supported order_item_cancelled order_item_not_found order_not_found ordering_not_provisioned parent_is_self parent_not_on_site partner_order_id_reused product_not_found product_write_partially_applied proof_not_pending_review quote_invalid quote_product_not_found rate_limit_exceeded search_not_available segment_not_on_site service_unavailable shipping_quote_unavailable site_id_required_for_search site_not_found sls_null_backfills_master submission_not_found template_not_found unknown_country_code unknown_query_parameter unknown_state_code unsupported_field_for_service_type updated_since_not_supported user_already_exists user_not_found variant_not_site_addressable

detail

required

Human-readable explanation. Do not parse this – it may be reworded without notice.

string

requestId

required

Echoes the request’s id. Include this when contacting Partner Integrations about a specific failed call – it resolves directly to one log entry.

string

Example

{
  "type": "about:blank",
  "title": "Service Unavailable",
  "status": 503,
  "code": "service_unavailable",
  "detail": "The service is temporarily unavailable. Please retry.",
  "requestId": "8f3c1e2a-..."
}