> ## Documentation Index
> Fetch the complete documentation index at: https://developers.jobhandy.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Bestellung abrufen

> Gibt die Bestellung zurück, wenn sie im Scope des API-Keys liegt.

## Auf einen Blick

| Eigenschaft       | Verhalten                                                                                  |
| ----------------- | ------------------------------------------------------------------------------------------ |
| Authentifizierung | Erforderlich in `X-API-Key`                                                                |
| Tenant-Kontext    | Optionale Einschränkung; Ressource und Referenzen müssen im Scope bleiben                  |
| Dry Run           | Nicht unterstützt                                                                          |
| Request-Body      | Keiner                                                                                     |
| Response          | JSON                                                                                       |
| Primärer Erfolg   | `200`                                                                                      |
| Side Effects      | Keine außer dem Lesen autorisierter Ressourcen                                             |
| Retry-Empfehlung  | Transiente Read-Fehler können in der Regel mit begrenztem Backoff sicher wiederholt werden |

## Betriebsverhalten

Gibt die Bestellung zurück, wenn sie im Scope des API-Keys liegt.

* Lesen Sie die Bestellung unmittelbar vor einer Entscheidung erneut und prüfen Sie Produkte, Mitarbeiter, Vertragsfelder, Status und Anhänge.

## Häufige Fehler

| Fehlercode              | Bedeutung                                              |
| ----------------------- | ------------------------------------------------------ |
| `VALIDATION_ERROR`      | Schema- oder fachliche Validierung ist fehlgeschlagen  |
| `INVALID_REQUEST_ID`    | `X-Request-ID` ist keine UUID v4 oder v7               |
| `INVALID_API_KEY`       | API-Key fehlt, ist ungültig, gelöscht oder inaktiv     |
| `TENANT_NOT_IN_SCOPE`   | Ausgewählter Tenant liegt außerhalb des API-Key-Scopes |
| `NOT_FOUND`             | Ressource fehlt oder ist im Scope nicht zugänglich     |
| `NOT_ACCEPTABLE`        | Angeforderter Response-Medientyp ist nicht verfügbar   |
| `RATE_LIMIT_EXCEEDED`   | Rate Limit des API-Keys wurde überschritten            |
| `INTERNAL_SERVER_ERROR` | Unerwarteter Serverfehler                              |

Die Response-Liste der Operation und die Seite [Fehlerbehandlung](/de/concepts/error-handling) sind für die vollständige Behandlung maßgeblich.

## Vor der Implementierung

* Erzeugen und protokollieren Sie für den Versuch eine neue `X-Request-ID`.
* Behandeln Sie jeden dokumentierten Response-Status.
* Protokollieren Sie weder `X-API-Key` noch unnötige personenbezogene Daten.

<Card title="Zugehöriger Integrationsleitfaden" href="/de/guides/process-orders" horizontal>
  Prüfen Sie den vollständigen Prozess sowie Status-, Retry- und Betriebsmuster für diese Operation.
</Card>


## OpenAPI

````yaml https://assets.jobhandy.io/api-spec/jobhandy-public-api.openapi.json GET /orders/{id}
openapi: 3.1.0
info:
  title: JobHandy Public API
  version: 1.0.0
  summary: Production API for HR, order, incident, division, and payroll integrations.
  description: >-
    Integrate HR and payroll systems with JobHandy through a versioned REST API.


    ## Production endpoint


    All public requests use `https://api.jobhandy.io/v1`.


    ## Core conventions


    - Authenticate protected operations with `X-API-Key`.

    - Use `X-Tenant-ID` where supported to select one tenant within the API-key
    scope.

    - Use `X-Request-ID` for end-to-end request correlation.

    - Validate supported writes with `dryRun=true` before applying them.

    - Collection endpoints support pagination, sorting, and the documented
    filter expression language.

    - Error responses use a stable JSON envelope with a machine-readable error
    code.


    Optional query and header parameters are documented but omitted from
    generated requests by default in the accompanying Mintlify configuration.
servers:
  - url: https://api.jobhandy.io/v1
    description: Production
security:
  - apiKeyAuth: []
tags:
  - name: Employees
    description: Synchronize employee master data, account state, and division assignments.
  - name: Orders
    description: Read employee orders, record HR decisions, and download order documents.
  - name: Incidents
    description: Report and maintain employee incidents and upload supported attachments.
  - name: Divisions
    description: Maintain organizational divisions, hierarchy, ordering, and cost centers.
  - name: Payroll export documents
    description: List payroll export metadata and download generated payroll files.
  - name: Health
    description: Check basic public API availability without authentication.
paths:
  /orders/{id}:
    get:
      tags:
        - Orders
      summary: Get an order
      description: Returns the order if it is in the API key's scope.
      operationId: getOrder
      parameters:
        - in: path
          name: id
          description: Order ID.
          required: true
          schema:
            type: string
            pattern: ^[0-9a-fA-F]{24}$
            example: 69eb125feddfff1d13676751
        - name: X-Tenant-ID
          description: >-
            Narrows the operation to one tenant in the API key's scope. Any
            referenced or target resource must be accessible through that
            tenant. In interactive clients, use the `{{tenantId}}` variable when
            a tenant must be selected. Keep the header disabled when tenant
            selection is not required.
          in: header
          required: false
          schema:
            type: string
            pattern: ^[0-9a-fA-F]{24}$
            x-mint:
              post:
                - optional
                - not sent by default
            x-client-default-state: inactive
            x-default: '{{tenantId}}'
        - in: header
          name: X-Request-ID
          required: false
          description: >-
            Optional request identifier. If supplied, it must be a UUID v4 or v7
            and is returned unchanged in every response. If omitted, the API
            generates one. Invalid values return `400 INVALID_REQUEST_ID`. If
            your client uses a `{{requestId}}` variable, refresh it with a new
            UUID version 4 or 7 for every HTTP request attempt. Keep the header
            disabled to let the API generate the request identifier.
          schema:
            type: string
            format: uuid
            pattern: >-
              ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
            x-mint:
              post:
                - optional
                - not sent by default
            x-client-default-state: inactive
            x-default: '{{requestId}}'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Order'
              examples:
                order:
                  summary: Order details
                  value:
                    id: 69eb125feddfff1d13676751
                    status: approved
                    employee: 68a000000000000000000001
                    orderNumber: 10495
                    createdAt: '2026-07-01T10:00:00.000Z'
                    updatedAt: '2026-07-02T12:15:00.000Z'
                    products:
                      - id: 69eb125feddfff1d13676761
                        label: Example Smartphone, 256 GB, Black, New
                        model: Example Smartphone
                        vatRate: '19.00'
                        manufacturerName: Example Manufacturer
                        articleGroupName: smartphones
                        grossAmount: '34.99'
                        netAmount: '29.4034'
                        service: false
                        grossService: null
                        netService: null
                        isAccessory: false
                      - id: 69eb125feddfff1d13676762
                        label: Example Protective Case
                        model: Example Protective Case
                        vatRate: '19.00'
                        manufacturerName: Example Manufacturer
                        articleGroupName: accessories
                        grossAmount: '3.99'
                        netAmount: '3.3529'
                        service: null
                        grossService: null
                        netService: null
                        isAccessory: true
                    deliveryAddress:
                      firstName: Alex
                      lastName: Morgan
                      street: Example Street 12
                      postalCode: '50667'
                      city: Cologne
                      countryCode: DE
                    contractDurationInMonths: 24
                    contractStartDate: '2026-08-01T00:00:00.000Z'
                    contractEndDate: '2028-07-31T23:59:59.999Z'
                    attachments:
                      - id: contract.10495.1
                        type: nuev
                      - id: contract.10495.2
                        type: emv
                    hrHistory:
                      approvedBy: null
                      approvedAt: '2026-07-02T12:15:00.000Z'
                      rejectedBy: null
                      rejectedAt: null
                      requestedAt: '2026-07-01T10:00:00.000Z'
                      decisionBy: null
          description: The requested order.
          headers:
            X-Request-ID:
              description: Request identifier returned for every public API response.
              schema:
                type: string
                format: uuid
                pattern: >-
                  ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
                example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
            RateLimit-Policy:
              description: Request quota policy expressed as an HTTP structured field.
              schema:
                type: string
            RateLimit:
              description: Current request quota availability and effective window.
              schema:
                type: string
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                validationError:
                  summary: >-
                    The request cannot be parsed or violates the request
                    contract.
                  value:
                    error:
                      code: VALIDATION_ERROR
                      message: The request contains an invalid value.
                      requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
                invalidRequestId:
                  summary: X-Request-ID is not UUID v4 or v7
                  value:
                    error:
                      code: INVALID_REQUEST_ID
                      message: The supplied X-Request-ID is invalid.
                      requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
          description: The request cannot be parsed or violates the request contract.
          headers:
            X-Request-ID:
              description: Request identifier returned for every public API response.
              schema:
                type: string
                format: uuid
                pattern: >-
                  ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
                example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                invalidApiKey:
                  summary: API key is missing, invalid, or inactive
                  value:
                    error:
                      code: INVALID_API_KEY
                      message: The supplied API key is missing, invalid, or inactive.
                      requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
          description: The X-API-Key credential is missing, invalid, or inactive.
          headers:
            X-Request-ID:
              description: Request identifier returned for every public API response.
              schema:
                type: string
                format: uuid
                pattern: >-
                  ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
                example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                tenantNotInScope:
                  summary: Selected tenant is not in the API-key scope
                  value:
                    error:
                      code: TENANT_NOT_IN_SCOPE
                      message: >-
                        The integration does not have access to the selected
                        tenant.
                      requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
          description: The API key does not grant access to the selected tenant.
          headers:
            X-Request-ID:
              description: Request identifier returned for every public API response.
              schema:
                type: string
                format: uuid
                pattern: >-
                  ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
                example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
            RateLimit-Policy:
              description: Request quota policy expressed as an HTTP structured field.
              schema:
                type: string
            RateLimit:
              description: Current request quota availability and effective window.
              schema:
                type: string
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                notFound:
                  summary: >-
                    The resource was not found or is outside the API key's
                    scope.
                  value:
                    error:
                      code: NOT_FOUND
                      message: The requested resource was not found.
                      requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
          description: The resource was not found or is outside the API key's scope.
          headers:
            X-Request-ID:
              description: Request identifier returned for every public API response.
              schema:
                type: string
                format: uuid
                pattern: >-
                  ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
                example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
            RateLimit-Policy:
              description: Request quota policy expressed as an HTTP structured field.
              schema:
                type: string
            RateLimit:
              description: Current request quota availability and effective window.
              schema:
                type: string
        '406':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                notAcceptable:
                  summary: Accept excludes all success media types
                  value:
                    error:
                      code: NOT_ACCEPTABLE
                      message: >-
                        The endpoint cannot produce a response in a media type
                        accepted by the request.
                      requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
          description: The requested response media type is not supported.
          headers:
            X-Request-ID:
              description: Request identifier returned for every public API response.
              schema:
                type: string
                format: uuid
                pattern: >-
                  ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
                example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                rateLimitExceeded:
                  summary: API-key request quota exceeded
                  value:
                    error:
                      code: RATE_LIMIT_EXCEEDED
                      message: The API key request rate limit has been exceeded.
                      requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
          description: The API key request rate limit was exceeded.
          headers:
            X-Request-ID:
              description: Request identifier returned for every public API response.
              schema:
                type: string
                format: uuid
                pattern: >-
                  ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
                example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
            RateLimit-Policy:
              description: Request quota policy expressed as an HTTP structured field.
              schema:
                type: string
            RateLimit:
              description: Current request quota availability and effective window.
              schema:
                type: string
            Retry-After:
              description: >-
                Seconds to wait before retrying after request-rate admission was
                rejected.
              schema:
                type: integer
                example: 60
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                internalServerError:
                  summary: Unexpected server error
                  value:
                    error:
                      code: INTERNAL_SERVER_ERROR
                      message: The request failed.
                      requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
          description: An unexpected server error occurred.
          headers:
            X-Request-ID:
              description: Request identifier returned for every public API response.
              schema:
                type: string
                format: uuid
                pattern: >-
                  ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
                example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
      security:
        - apiKeyAuth: []
components:
  schemas:
    Order:
      type: object
      properties:
        id:
          type: string
          pattern: ^[0-9a-fA-F]{24}$
          readOnly: true
          description: Unique order identifier.
          example: 69eb125feddfff1d13676751
        status:
          type: string
          enum:
            - under_review
            - rejected
            - approved
            - active
            - archived
            - withdrawn
          readOnly: true
          minLength: 1
          description: Current order lifecycle status. Values are case-sensitive.
          example: approved
        employee:
          type: string
          pattern: ^[0-9a-fA-F]{24}$
          description: Identifier of the employee who placed or owns the order.
          example: 68a000000000000000000001
        orderNumber:
          type: integer
          readOnly: true
          multipleOf: 1
          description: Human-readable numeric order number.
          example: 10495
        createdAt:
          type: string
          pattern: Z$
          format: date-time
          readOnly: true
          minLength: 1
          description: UTC timestamp at which the order was created.
          example: '2026-07-01T10:00:00.000Z'
        updatedAt:
          type: string
          pattern: Z$
          format: date-time
          readOnly: true
          minLength: 1
          description: UTC timestamp of the latest order update.
          example: '2026-07-02T12:15:00.000Z'
        products:
          type: array
          items:
            $ref: '#/components/schemas/OrderProduct'
          description: Products and accessories included in the order.
        deliveryAddress:
          description: >-
            Delivery address for the order, or `null` when no delivery address
            is available.
          anyOf:
            - allOf:
                - $ref: '#/components/schemas/OrderDeliveryAddress'
            - type: 'null'
          x-mint:
            post:
              - nullable
        hrHistory:
          readOnly: true
          allOf:
            - $ref: '#/components/schemas/OrderHrHistory'
          description: HR review request and decision history.
        contractDurationInMonths:
          type:
            - number
            - 'null'
          multipleOf: 1
          description: Contract duration in whole months, or `null` when not determined.
          example: 24
          x-mint:
            post:
              - nullable
        contractStartDate:
          type:
            - string
            - 'null'
          minLength: 1
          pattern: Z$
          format: date-time
          description: UTC contract start date, or `null` when not determined.
          example: '2026-08-01T00:00:00.000Z'
          x-mint:
            post:
              - nullable
        contractEndDate:
          type:
            - string
            - 'null'
          minLength: 1
          pattern: Z$
          format: date-time
          description: UTC contract end date, or `null` when not determined.
          example: '2028-07-31T23:59:59.999Z'
          x-mint:
            post:
              - nullable
        attachments:
          type: array
          items:
            $ref: '#/components/schemas/OrderAttachment'
          description: >-
            Order contract documents available through the order attachment
            download endpoint.
      description: Order details.
      required:
        - id
        - status
        - employee
        - orderNumber
        - createdAt
        - updatedAt
        - products
        - deliveryAddress
        - hrHistory
        - contractDurationInMonths
        - contractStartDate
        - contractEndDate
        - attachments
      example:
        id: 69eb125feddfff1d13676751
        status: approved
        employee: 68a000000000000000000001
        orderNumber: 10495
        createdAt: '2026-07-01T10:00:00.000Z'
        updatedAt: '2026-07-02T12:15:00.000Z'
        products:
          - id: 69eb125feddfff1d13676761
            label: Example Smartphone, 256 GB, Black, New
            model: Example Smartphone
            vatRate: '19.00'
            manufacturerName: Example Manufacturer
            articleGroupName: smartphones
            grossAmount: '34.99'
            netAmount: '29.4034'
            service: false
            grossService: null
            netService: null
            isAccessory: false
          - id: 69eb125feddfff1d13676762
            label: Example Protective Case
            model: Example Protective Case
            vatRate: '19.00'
            manufacturerName: Example Manufacturer
            articleGroupName: accessories
            grossAmount: '3.99'
            netAmount: '3.3529'
            service: null
            grossService: null
            netService: null
            isAccessory: true
        deliveryAddress:
          firstName: Alex
          lastName: Morgan
          street: Example Street 12
          postalCode: '50667'
          city: Cologne
          countryCode: DE
        contractDurationInMonths: 24
        contractStartDate: '2026-08-01T00:00:00.000Z'
        contractEndDate: '2028-07-31T23:59:59.999Z'
        attachments:
          - id: contract.10495.1
            type: nuev
          - id: contract.10495.2
            type: emv
        hrHistory:
          approvedBy: null
          approvedAt: '2026-07-02T12:15:00.000Z'
          rejectedBy: null
          rejectedAt: null
          requestedAt: '2026-07-01T10:00:00.000Z'
          decisionBy: null
    ErrorResponse:
      type: object
      properties:
        error:
          allOf:
            - $ref: '#/components/schemas/ApiError'
            - type: object
              description: Public error details.
          description: Machine-readable and human-readable details for the failed request.
      example:
        error:
          code: INVALID_API_KEY
          message: The supplied API key is missing, invalid, or inactive.
          requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
      description: Error envelope returned by every public API endpoint.
      required:
        - error
    OrderProduct:
      type: object
      properties:
        id:
          type: string
          description: Product ID.
          pattern: ^[0-9a-fA-F]{24}$
          readOnly: true
          example: 69eb125feddfff1d13676761
        label:
          type: string
          description: Product label.
          example: Example Smartphone, 256 GB, Black, New
        model:
          type:
            - string
            - 'null'
          minLength: 1
          description: Product model, or null when unavailable.
          example: Example Smartphone
          x-mint:
            post:
              - nullable
        vatRate:
          type: string
          description: VAT rate as a decimal percentage string.
          pattern: ^\d+\.\d{2}$
          example: '19.00'
        manufacturerName:
          type:
            - string
            - 'null'
          minLength: 1
          description: Product manufacturer, or null when unavailable.
          example: Example Manufacturer
          x-mint:
            post:
              - nullable
        articleGroupName:
          type:
            - string
            - 'null'
          minLength: 1
          description: Product article group, or null when unavailable.
          example: smartphones
          x-mint:
            post:
              - nullable
        grossAmount:
          type: string
          description: Gross monthly amount in euros as a decimal string.
          pattern: ^\d+\.\d{2}$
          example: '43.90'
        netAmount:
          type: string
          description: Net monthly amount in euros as a decimal string.
          pattern: ^\d+\.\d{4}$
          example: '36.8908'
        service:
          type:
            - boolean
            - 'null'
          description: Whether a service is selected, or null for an accessory.
          example: false
          x-mint:
            post:
              - nullable
        grossService:
          type:
            - string
            - 'null'
          minLength: 1
          description: >-
            Gross monthly service amount in euros, or null when no service
            applies.
          pattern: ^\d+\.\d{2}$
          example: null
          x-mint:
            post:
              - nullable
        netService:
          type:
            - string
            - 'null'
          minLength: 1
          description: >-
            Net monthly service amount in euros, or null when no service
            applies.
          pattern: ^\d+\.\d{2}$
          example: null
          x-mint:
            post:
              - nullable
        isAccessory:
          type: boolean
          description: Whether this entry is an accessory rather than the main product.
          example: false
      description: Product information included in an order.
      required:
        - id
        - label
        - model
        - vatRate
        - manufacturerName
        - articleGroupName
        - grossAmount
        - netAmount
        - service
        - grossService
        - netService
        - isAccessory
      example:
        id: 69eb125feddfff1d13676761
        label: Example Smartphone, 256 GB, Black, New
        model: Example Smartphone
        vatRate: '19.00'
        manufacturerName: Example Manufacturer
        articleGroupName: smartphones
        grossAmount: '43.90'
        netAmount: '36.8908'
        service: false
        grossService: null
        netService: null
        isAccessory: false
    OrderDeliveryAddress:
      type: object
      properties:
        firstName:
          type: string
          description: Recipient first name.
          example: Alex
        lastName:
          type: string
          description: Recipient last name.
          example: Morgan
        street:
          type: string
          description: Delivery street and house number.
          example: Example Street 12
        postalCode:
          type: string
          description: Delivery postal code.
          example: '50667'
        city:
          type: string
          description: Delivery city.
          example: Cologne
        countryCode:
          type: string
          example: DE
          description: Uppercase two-character delivery country or territory code.
      description: Delivery address for an order.
      required:
        - firstName
        - lastName
        - street
        - postalCode
        - city
        - countryCode
      example:
        firstName: Alex
        lastName: Morgan
        street: Example Street 12
        postalCode: '50667'
        city: Cologne
        countryCode: DE
    OrderHrHistory:
      type: object
      properties:
        approvedBy:
          type:
            - string
            - 'null'
          minLength: 1
          pattern: ^[0-9a-fA-F]{24}$
          description: >-
            ID of the user associated with the approval, or `null` when no user
            ID is available.
          example: null
          x-mint:
            post:
              - nullable
        approvedAt:
          type:
            - string
            - 'null'
          minLength: 1
          pattern: Z$
          format: date-time
          description: >-
            UTC timestamp at which the order was approved, or `null` when it has
            not been approved.
          example: '2026-07-02T12:15:00.000Z'
          x-mint:
            post:
              - nullable
        rejectedBy:
          type:
            - string
            - 'null'
          minLength: 1
          pattern: ^[0-9a-fA-F]{24}$
          description: >-
            ID of the user who rejected the order, or null for automated
            decisions and orders that have not been rejected.
          example: null
          x-mint:
            post:
              - nullable
        rejectedAt:
          type:
            - string
            - 'null'
          minLength: 1
          pattern: Z$
          format: date-time
          description: >-
            Time at which the order was rejected, or null when it has not been
            rejected.
          example: null
          x-mint:
            post:
              - nullable
        requestedAt:
          type:
            - string
            - 'null'
          minLength: 1
          pattern: Z$
          format: date-time
          description: >-
            UTC timestamp at which HR review was requested, or `null` when no
            review was requested.
          example: '2026-07-01T10:05:00.000Z'
          x-mint:
            post:
              - nullable
        decisionBy:
          type:
            - string
            - 'null'
          minLength: 1
          pattern: ^[0-9a-fA-F]{24}$
          description: >-
            ID of the user who made the decision, or null for automated and
            API-key decisions.
          example: null
          x-mint:
            post:
              - nullable
      description: HR review decision details.
      required:
        - approvedBy
        - approvedAt
        - rejectedBy
        - rejectedAt
        - requestedAt
        - decisionBy
      example:
        approvedBy: null
        approvedAt: '2026-07-02T12:15:00.000Z'
        rejectedBy: null
        rejectedAt: null
        requestedAt: '2026-07-01T10:05:00.000Z'
        decisionBy: null
    OrderAttachment:
      type: object
      properties:
        id:
          type: string
          description: >-
            Attachment identifier used by the order attachment download
            endpoint.
          example: contract.10495.1
        type:
          type: string
          enum:
            - nuev
            - emv
          minLength: 1
          description: Contract document type. Values are case-sensitive.
          example: nuev
      description: Order contract document available for download.
      required:
        - id
        - type
      example:
        id: contract.10495.1
        type: nuev
    ApiError:
      type: object
      properties:
        code:
          type: string
          example: INVALID_API_KEY
          description: >-
            Machine-readable public error code. Values are stable and
            case-sensitive.


            - `INVALID_API_KEY`: The API key is missing, invalid, inactive, or
            otherwise unusable.

            - `INVALID_REQUEST_ID`: X-Request-ID is not a valid UUID version 4
            or 7.

            - `NOT_ACCEPTABLE`: The Accept header excludes all success media
            types produced by the operation.

            - `UNSUPPORTED_MEDIA_TYPE`: The request Content-Type is not
            supported by the operation.

            - `MISSING_ATTACHMENT`: A required multipart attachment field or
            file is missing.

            - `PAYLOAD_TOO_LARGE`: The complete request body exceeds the
            documented 5 MiB limit.

            - `UNKNOWN_QUERY_PARAMETER`: The request contains a query parameter
            that the operation does not accept.

            - `UNSUPPORTED_HEADER`: The request contains a header value or
            header usage that the public contract does not support.

            - `NOT_FOUND`: The target resource does not exist or is not visible
            in the caller scope.

            - `FILE_NOT_FOUND`: The referenced file is not available.

            - `BAD_GATEWAY`: A downstream file or integration service failed
            while processing the request.

            - `SERVICE_UNAVAILABLE`: The requested service is temporarily
            unavailable.

            - `GATEWAY_TIMEOUT`: A downstream operation did not complete before
            the timeout.

            - `INTERNAL_SERVER_ERROR`: An unexpected server-side error occurred.

            - `TENANT_CONTEXT_AMBIGUOUS`: The API cannot infer exactly one
            tenant from the supplied selectors and API-key scope.

            - `EMPLOYEE_PLACEMENT_AMBIGUOUS`: The API cannot infer one permitted
            employee division placement.

            - `TENANT_NOT_IN_SCOPE`: The selected tenant is not accessible to
            the API key.

            - `INVALID_REFERENCE_ID`: A referenced identifier is invalid for the
            requested operation.

            - `VALIDATION_ERROR`: The request is malformed or a supplied value
            fails contract or business validation.

            - `INVALID_FILTER_SYNTAX`: The filter expression cannot be parsed.

            - `UNSUPPORTED_FILTER_FIELD`: The filter uses a field that the
            operation does not expose for filtering.

            - `UNSUPPORTED_FILTER_OPERATOR`: The filter uses an operator that is
            not supported for the selected field.

            - `UNSUPPORTED_SORT_FIELD`: The sort field is not supported by the
            operation.

            - `UNSUPPORTED_FIELD`: The request contains a field that is not
            accepted by the operation.

            - `INVALID_REFERENCE`: A referenced resource cannot be used in the
            requested context or scope.

            - `EMPLOYEE_BLOCKED`: The requested operation cannot continue
            because the employee account is blocked.

            - `DIVISION_CYCLE`: The requested parent relationship would create a
            division hierarchy cycle.

            - `DIVISION_NAME_NOT_UNIQUE_ON_SAME_LEVEL`: A sibling division
            already uses the requested name.

            - `DUPLICATE_RESOURCE`: The request would create or update a
            resource to a value that must be unique.

            - `INVALID_STATE_TRANSITION`: The requested action is not permitted
            from the resource current lifecycle state.

            - `ORDER_ALREADY_DECIDED`: The order already has an HR review
            decision and cannot be decided again.

            - `RATE_LIMIT_EXCEEDED`: The API-key request quota has been
            exceeded.
          enum:
            - INVALID_API_KEY
            - INVALID_REQUEST_ID
            - NOT_ACCEPTABLE
            - UNSUPPORTED_MEDIA_TYPE
            - MISSING_ATTACHMENT
            - PAYLOAD_TOO_LARGE
            - UNKNOWN_QUERY_PARAMETER
            - UNSUPPORTED_HEADER
            - NOT_FOUND
            - FILE_NOT_FOUND
            - BAD_GATEWAY
            - SERVICE_UNAVAILABLE
            - GATEWAY_TIMEOUT
            - INTERNAL_SERVER_ERROR
            - TENANT_CONTEXT_AMBIGUOUS
            - EMPLOYEE_PLACEMENT_AMBIGUOUS
            - TENANT_NOT_IN_SCOPE
            - INVALID_REFERENCE_ID
            - VALIDATION_ERROR
            - INVALID_FILTER_SYNTAX
            - UNSUPPORTED_FILTER_FIELD
            - UNSUPPORTED_FILTER_OPERATOR
            - UNSUPPORTED_SORT_FIELD
            - UNSUPPORTED_FIELD
            - INVALID_REFERENCE
            - EMPLOYEE_BLOCKED
            - DIVISION_CYCLE
            - DIVISION_NAME_NOT_UNIQUE_ON_SAME_LEVEL
            - DUPLICATE_RESOURCE
            - INVALID_STATE_TRANSITION
            - ORDER_ALREADY_DECIDED
            - RATE_LIMIT_EXCEEDED
          minLength: 1
        message:
          type: string
          example: The supplied API key is missing, invalid, or inactive.
          description: Human-readable error summary.
          minLength: 1
        requestId:
          type: string
          example: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
          description: >-
            Request identifier also returned in the X-Request-ID response
            header.
          pattern: >-
            ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[47][0-9a-fA-F]{3}-[89aAbB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          format: uuid
          minLength: 1
      description: Stable public API error details.
      required:
        - code
        - message
        - requestId
      example:
        code: VALIDATION_ERROR
        message: The request contains an invalid value.
        requestId: 018f3d9a-7dfb-7a23-b4b4-9f7e4b19d4b4
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      name: X-API-Key
      in: header
      description: >-
        JobHandy integration API key. Send the credential in the `X-API-Key`
        header. Treat the key as a secret and use it only from trusted
        server-side environments.

````