# Cancel an order

`POST https://management.horeca-24.de/api/partner/v1/orders/{externalId}/cancel`

Approved at once in v1; the till shows the order as cancelled (the `reason` is not shown there). You also
receive `order.cancelled` with `reason.code: PARTNER_REQUESTED`. An order cancelled already answers `200` again,
so retries are safe. `409 INVALID_TRANSITION` for a `completed` or `rejected` order.

## Headers

- `Authorization` (string, required): Bearer $PARTNER_API_KEY

## Path parameters

- `externalId` (string, required, pattern: `^[A-Za-z0-9._~-]{1,64}$`)
  Your order id, as sent in `POST /orders`.

## Request

`application/json`

- `reason` (string, required, 1-500 chars)

## Response

### 200 — Cancelled, also when it was cancelled already

- `externalId` (string, required, pattern: `^[A-Za-z0-9._~-]{1,64}$`)
  Your order id, unique per connection
- `status` (string, required, Value: `cancelled`)
- `version` (integer, required, ≥ 1)

## Errors

- `400`: An error; see `ErrorCode`
- `401`: `UNAUTHORIZED`: the key is missing, malformed, unknown, wrong, expired or revoked
- `403`: `CONNECTION_REVOKED`: the restaurant deleted the connection; stop sending
- `404`: An error; see `ErrorCode`
- `409`: An error; see `ErrorCode`
- `422`: An error; see `ErrorCode`
- `429`: `RATE_LIMITED`: 60 per minute and connection, shared by orders, cancel and delivery

## Code example (cURL)

```sh
curl -X POST https://management.horeca-24.de/api/partner/v1/orders/A/cancel \
  -H "Authorization: Bearer $PARTNER_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
  "reason": "Customer cancelled"
}'
```

## Response 200 — Example

```json
{
  "externalId": "A-1001",
  "status": "cancelled",
  "version": 3
}
```