POST Cancel a pending order

/api/v1/account/orders/{id}/cancel

Cancel a still unprocessed order with its current revision, explicit confirmation and reason. Repeated cancellation is safe. Operator actions record the actual administrator and reason. This does not cancel an activated subscription or issue a refund; neither payments nor activation exist in this phase.

On this page

Access and permissions

Browser session: __Host-mb_session cookie.

When using a browser session for a mutation, send the current CSRF token in X-CSRF-Token with the same-site cookie. OAuth consent uses its documented form field.

Parameters and headers

Field	Location	Type and limits	Required	Meaning
id	Path	string; {"format":"uuid"}	Yes	Order identifier.
workspace_id	URL query	string; {"format":"uuid"}	No	Limit the list to an accessible workspace.
X-CSRF-Token	Header	string	Yes	Current browser security proof; must match the loaded session.
X-MetriBeacon-Session-Context	Header	string	Yes	Current browser security proof; must match the loaded session.

Request body

Field	Type and limits	Required	Meaning
$	PackageOrderCancellation	Yes	—
$.confirmed	boolean; {"const":true}	Yes	—
$.reason	string; {"maxLength":2000,"minLength":1}	Yes	—
$.revision	integer; {"minimum":1}	Yes	—

Responses

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/json

Field	Type and limits	Required	Meaning
$	PackageOrder	Yes	—
$.account_email	string	Yes	—
$.account_id	string \| null	Yes	—
$.account_id (anyOf 1)	string	No	—
$.account_id (anyOf 2)	null	No	—
$.activation_status	string; {"enum":["not_activated"]}	Yes	—
$.cancelled_at	string; {"format":"date-time"} \| null	Yes	—
$.cancelled_at (anyOf 1)	string; {"format":"date-time"}	No	—
$.cancelled_at (anyOf 2)	null	No	—
$.created_at	string; {"format":"date-time"}	Yes	—
$.id	string	Yes	—
$.invoice_status	string; {"enum":["not_created"]}	Yes	—
$.number	string	Yes	—
$.payment_status	string; {"enum":["not_requested"]}	Yes	—
$.revision	integer	Yes	—
$.snapshot	PackageOrderSnapshot	Yes	—
$.snapshot.address	BillingAddress	Yes	International billing address. Postal code and state requirements follow the country; company is required for businesses. A supplied Tax ID must be verified by the provider before it can affect tax.
$.snapshot.address.city	string	Yes	—
$.snapshot.address.company	string	No	—
$.snapshot.address.country	string; {"maxLength":2,"minLength":2,"pattern":"^[A-Z]{2}$"}	Yes	—
$.snapshot.address.kind	string; {"enum":["personal","business"]}	Yes	—
$.snapshot.address.line1	string	Yes	—
$.snapshot.address.line2	string	No	—
$.snapshot.address.name	string	Yes	—
$.snapshot.address.postal_code	string; {"maxLength":32}	Yes	—
$.snapshot.address.state	string; {"maxLength":64}	No	—
$.snapshot.address.tax_id	string	No	—
$.snapshot.address.tax_id_type	string	No	—
$.snapshot.billing	string	Yes	—
$.snapshot.breakdown	array<object>	Yes	—
$.snapshot.breakdown[]	object	Yes	—
$.snapshot.breakdown[].amount	integer	Yes	—
$.snapshot.breakdown[].tax_rate_details	object	Yes	—
$.snapshot.breakdown[].tax_rate_details.country	string	Yes	—
$.snapshot.breakdown[].tax_rate_details.percentage_decimal	string	Yes	—
$.snapshot.breakdown[].tax_rate_details.state	string	Yes	—
$.snapshot.breakdown[].tax_rate_details.tax_type	string	Yes	—
$.snapshot.breakdown[].taxability_reason	string	Yes	—
$.snapshot.breakdown[].taxable_amount	integer	Yes	—
$.snapshot.calculation_id	string	Yes	—
$.snapshot.catalog_revision	integer	Yes	—
$.snapshot.config_version	string	Yes	—
$.snapshot.currency	string	Yes	—
$.snapshot.expires_at	string; {"format":"date-time"}	Yes	—
$.snapshot.language	string	Yes	—
$.snapshot.net_cents	integer	Yes	—
$.snapshot.payment_method	string	Yes	—
$.snapshot.plan	PricingPlan	Yes	—
$.snapshot.plan.id	string; {"enum":["free","essentials","pro","business","enterprise"]}	Yes	—
$.snapshot.plan.monthly_cents	integer \| null; {"minimum":0,"maximum":1000000000}	Yes	—
$.snapshot.plan.yearly_cents	integer \| null; {"minimum":0,"maximum":1000000000}	Yes	—
$.snapshot.plan.values	object	Yes	—
$.snapshot.plan.retention	PlanRetention	Yes	—
$.snapshot.plan.retention.raw	integer; {"minimum":1,"maximum":30}	Yes	—
$.snapshot.plan.retention.minute	integer; {"minimum":1,"maximum":30}	Yes	—
$.snapshot.plan.retention.quarter_hour	integer; {"minimum":1,"maximum":365}	Yes	—
$.snapshot.plan.retention.hour	integer; {"minimum":1,"maximum":1095}	Yes	—
$.snapshot.plan.retention.text	integer; {"minimum":1,"maximum":7}	Yes	—
$.snapshot.plan.retention.logs	integer; {"minimum":1,"maximum":30}	Yes	—
$.snapshot.plan_id	string	Yes	—
$.snapshot.profile_revision	integer	Yes	—
$.snapshot.tax_cents	integer	Yes	—
$.snapshot.tax_id_verified	boolean	Yes	—
$.snapshot.terms	object	Yes	—
$.snapshot.terms_version	string	Yes	—
$.snapshot.total_cents	integer	Yes	—
$.status	string; {"enum":["received","cancelled"]}	Yes	—

{
  "id": "00000000-0000-4000-8000-000000000001",
  "number": "MB-2026-1",
  "account_id": "00000000-0000-4000-8000-000000000002",
  "account_email": "owner@example.test",
  "status": "cancelled",
  "invoice_status": "not_created",
  "payment_status": "not_requested",
  "activation_status": "not_activated",
  "revision": 2,
  "created_at": "2026-10-29T12:00:00Z",
  "cancelled_at": "2026-10-29T12:05:00Z",
  "snapshot": {
    "plan_id": "essentials",
    "billing": "monthly",
    "currency": "EUR",
    "payment_method": "bank_transfer",
    "address": {
      "kind": "personal",
      "name": "Example Customer",
      "line1": "Example Street 1",
      "postal_code": "10115",
      "city": "Berlin",
      "country": "DE"
    },
    "profile_revision": 0,
    "plan": {
      "id": "essentials",
      "monthly_cents": 2900,
      "yearly_cents": 29000,
      "values": {
        "projects": {
          "kind": "unlimited"
        },
        "seats": {
          "kind": "number",
          "value": 3,
          "extra_cents": 700
        },
        "google_sso": {
          "kind": "included"
        },
        "enterprise_identity": {
          "kind": "excluded"
        },
        "saml_sso": {
          "kind": "excluded"
        },
        "priority_support": {
          "kind": "excluded"
        },
        "audit_logs": {
          "kind": "excluded"
        },
        "monitors": {
          "kind": "number",
          "value": 50
        },
        "check_interval": {
          "kind": "number",
          "value": 30
        },
        "maintenance": {
          "kind": "included"
        },
        "ssl": {
          "kind": "included"
        },
        "dns": {
          "kind": "included"
        },
        "notifications": {
          "kind": "included"
        },
        "incident_integrations": {
          "kind": "included"
        },
        "sms_credits": {
          "kind": "number",
          "value": 20
        },
        "calls": {
          "kind": "included"
        },
        "healthchecks": {
          "kind": "included"
        },
        "weekly_reports": {
          "kind": "included"
        },
        "regions": {
          "kind": "number",
          "value": 18
        },
        "browser_checks": {
          "kind": "number",
          "value": 3
        },
        "browser_interval": {
          "kind": "number",
          "value": 300
        },
        "sla_reports": {
          "kind": "included"
        },
        "server_agents": {
          "kind": "number",
          "value": 5
        },
        "additional_server": {
          "kind": "number",
          "value": 200
        },
        "server_metrics": {
          "kind": "included"
        },
        "server_alerting": {
          "kind": "included"
        },
        "on_call": {
          "kind": "number",
          "value": 1
        },
        "escalation": {
          "kind": "included"
        },
        "manual_incidents": {
          "kind": "included"
        },
        "acknowledge": {
          "kind": "included"
        },
        "assistant": {
          "kind": "number",
          "value": 10
        },
        "investigations": {
          "kind": "number",
          "value": 3
        },
        "own_ai_key": {
          "kind": "included"
        },
        "mcp": {
          "kind": "included"
        },
        "status_pages": {
          "kind": "number",
          "value": 1
        },
        "custom_domains": {
          "kind": "number",
          "value": 1
        },
        "hosted_domain": {
          "kind": "included"
        },
        "embedded_charts": {
          "kind": "included"
        },
        "manual_components": {
          "kind": "included"
        },
        "subscribers": {
          "kind": "number",
          "value": 100
        },
        "sms_subscribers": {
          "kind": "excluded"
        },
        "status_incidents": {
          "kind": "included"
        },
        "intercom": {
          "kind": "excluded"
        },
        "private_pages": {
          "kind": "excluded"
        },
        "email_codes": {
          "kind": "excluded"
        },
        "analytics": {
          "kind": "excluded"
        },
        "tv_mode": {
          "kind": "excluded"
        },
        "languages": {
          "kind": "excluded"
        },
        "hide_search": {
          "kind": "excluded"
        },
        "white_label": {
          "kind": "excluded"
        },
        "email_domain": {
          "kind": "excluded"
        },
        "sso_standard": {
          "kind": "excluded"
        },
        "sso_extended": {
          "kind": "excluded"
        },
        "reporting": {
          "kind": "included"
        },
        "csv": {
          "kind": "included"
        },
        "incident_kpis": {
          "kind": "included"
        },
        "log_volume": {
          "kind": "number",
          "value": 5000000000
        },
        "log_overage": {
          "kind": "number",
          "value": 25
        },
        "enterprise_sso": {
          "kind": "excluded"
        },
        "enterprise_contract": {
          "kind": "excluded"
        },
        "enterprise_migration": {
          "kind": "excluded"
        },
        "enterprise_support": {
          "kind": "excluded"
        }
      },
      "retention": {
        "raw": 7,
        "minute": 7,
        "quarter_hour": 7,
        "hour": 7,
        "text": 7,
        "logs": 30
      }
    },
    "catalog_revision": 1,
    "terms_version": "0000000000000000000000000000000000000000000000000000000000000000",
    "terms": {
      "en": {
        "body": "Example order terms for this API response: the selected contract starts upon later activation after confirmed payment. Publish complete terms before accepting real orders.",
        "renewal": "Example: monthly term, automatic renewal according to the accepted conditions."
      },
      "de": {
        "body": "Example order terms for this API response: the selected contract starts upon later activation after confirmed payment. Publish complete terms before accepting real orders.",
        "renewal": "Example: monthly term, automatic renewal according to the accepted conditions."
      }
    },
    "config_version": "1111111111111111111111111111111111111111111111111111111111111111",
    "language": "en",
    "calculation_id": "taxcalc_example",
    "net_cents": 2900,
    "tax_cents": 551,
    "total_cents": 3451,
    "expires_at": "2026-10-29T12:30:00Z",
    "tax_id_verified": false,
    "breakdown": [
      {
        "amount": 551,
        "taxable_amount": 2900,
        "taxability_reason": "standard_rated",
        "tax_rate_details": {
          "country": "DE",
          "state": "",
          "percentage_decimal": "19.0",
          "tax_type": "vat"
        }
      }
    ]
  }
}

Stable error codes
unauthorized
invalid_credential

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 401,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
order_forbidden
csrf
csrf_failed
invalid_origin
owner_required

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 403,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
order_not_found

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 404,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
session_context_changed
quote_pending
order_conflict

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 409,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
invalid_order
tax_id_unverified
tax_region_unavailable
invalid_cursor

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 422,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
tax_rate_limited

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 429,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
ordering_unavailable
tax_unavailable

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Retry-After	string; {"pattern":"^[0-9]+$"}	Seconds before retry. Preserve supported idempotency identifiers and respect the operation’s mutation semantics.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 503,
  "title": "Demo error",
  "type": "about:blank"
}

Retries and asynchronous work

This change does not have a general retry guarantee. If the response is unclear, read the affected resource before trying again. Follow Retry-After waiting times and request new sign-in or action codes when they expire.

Request examples

Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.

Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.

curl --request POST --cookie '__Host-mb_session=<session>' --header 'Origin: https://metribeacon.com' --header 'X-CSRF-Token: <csrf>' --header 'X-MetriBeacon-Session-Context: <context>' --header 'Content-Type: application/json' --header 'Idempotency-Key: 00000000-0000-4000-8000-000000000002' --data '{"revision":1,"confirmed":true,"reason":"Cancelled by owner"}' 'https://metribeacon.com/api/v1/account/orders/00000000-0000-4000-8000-000000000001/cancel'

import requests
response = requests.request('POST', 'https://metribeacon.com/api/v1/account/orders/00000000-0000-4000-8000-000000000001/cancel', cookies={'__Host-mb_session': '<session>'}, headers={'Origin': 'https://metribeacon.com', 'X-CSRF-Token': '<csrf>', 'X-MetriBeacon-Session-Context': '<context>', 'Idempotency-Key': '00000000-0000-4000-8000-000000000002'}, json={'revision': 1, 'confirmed': True, 'reason': 'Cancelled by owner'})
response.raise_for_status()

const response = await fetch('/api/v1/account/orders/{id}/cancel', {method: 'POST', credentials: 'same-origin', headers: {'Content-Type': 'application/json', 'X-CSRF-Token': '<csrf>', 'X-MetriBeacon-Session-Context': '<context>', 'Idempotency-Key': '00000000-0000-4000-8000-000000000002'}, body: JSON.stringify({"revision":1,"confirmed":true,"reason":"Cancelled by owner"})});

package main

import (
	"net/http"
	"strings"
)

func main() {
	req, _ := http.NewRequest("POST", "https://metribeacon.com/api/v1/account/orders/00000000-0000-4000-8000-000000000001/cancel", strings.NewReader("{\"revision\":1,\"confirmed\":true,\"reason\":\"Cancelled by owner\"}"))
	req.Header.Set("Cookie", "__Host-mb_session=<session>")
	req.Header.Set("Origin", "https://metribeacon.com")
	req.Header.Set("X-CSRF-Token", "<csrf>")
	req.Header.Set("X-MetriBeacon-Session-Context", "<context>")
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Idempotency-Key", "00000000-0000-4000-8000-000000000002")
	response, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer response.Body.Close()
}

HTTP API, OAuth and MCP
Find the user API endpoints, their permissions, fields, examples and response formats.
GET Read a package order
Read the immutable commercial snapshot, separate processing statuses and change history. Access requires the owner session or an active operator on the operator endpoint.
GET List package orders
List orders with status, plan and text filters and cursor pagination of 50 rows. Customer sessions see only their own orders; operator sessions on the operator endpoint see all accounts. Summaries exclude billing addresses and full terms.
POST Place a package order
Submit an unexpired quote after accepting its exact terms version. Use a new UUID Idempotency-Key for one submission and reuse it on manual retries after an uncertain response. The same key with different content is rejected. There is at most one pending order per account. An encrypted outbox sends the receipt; the billing profile updates only after successful submission. Orders preserve immutable prices, tax, address and terms. Invoice, payment and activation remain pending for the later NextOffice integration. Existing package limits and retention stay unchanged.

Access and permissions

Parameters and headers

Request body

Responses

Retries and asynchronous work

Request examples

Related guides