Introducing our brand new Rules Engine —
Read the docs
LogoLogo
Core APIOther APIsChangelog
Getting started
Getting started
  • Welcome to Commerce Layer
    • Guided setup
    • Manual configuration
  • API specification
  • API credentials
  • Authentication
    • Client credentials
    • Password
    • Authorization code
    • Refresh token
    • JWT bearer
    • Revoking a token
  • Roles and permissions
  • Fetching resources
  • Fetching relationships
  • Including associations
  • Sparse fieldsets
  • Sorting results
  • Pagination
  • Filtering data
  • Creating resources
  • Updating resources
  • Tagging resources
  • Deleting resources
  • Importing resources
  • Exporting resources
  • Cleaning up resources
  • External resources
    • External order validation
    • External prices
    • External shipping costs
    • External payment gateways
    • External promotions
    • External tax calculators
  • Rate limits
  • Handling errors
  • Real-time webhooks
  • Callbacks security
On this page
  • Triggering external validation
  • Request
  • Response
  • Security
  1. External resources

External order validation

How to validate orders via external services

PreviousExternal resourcesNextExternal prices

Last updated 7 months ago

Sometimes, you may need to perform custom validation on orders, as an additional step before the order placement. For example, this could be useful in case you want to support different or more complex validation rules specific to your business logic.

If you want to use the external order validation feature in a , fill in the market's external_order_validation_url field with your external service endpoint and make sure your service is compliant with the specifications described below.

Triggering external validation

When you want to validate an order based on your external logic, it and set the _validate attribute to true:

curl -g -X PATCH \
  'https://yourdomain.commercelayer.io/api/orders/xYZkjABcde' \
  -H 'Accept: application/vnd.api+json' \
  -H 'Authorization: Bearer your-access-token' \
  -H 'Content-Type: application/vnd.api+json' \
  -d '{
    "data": {
      "type": "orders",
      "id": "xYZkjABcde",
      "attributes": {
        "_validate": true
      }
    }
  }'

Upon this call, Commerce Layer triggers a POST request to the specified external_validation_url endpoint, sending the order payload (including the related line items) in the request body.

To check if an external order validation has been triggered you can inspect the order's validations_count attribute and make sure it gets incremented.

Request

  • billing_address

  • shipping_address

  • line_items.item

  • line_items

  • market

  • customer

  • shipments

  • shipments.shipping_method

{
  "data": {
    "id": "wBXVhKzrnq",
    "type": "orders",
    "links": { ... },
    "attributes": { ... },
    "relationships": { ... },
    "meta": { ... }
  },
  "included": [
    {
      "id": "DvlGRmhdgX",
      "type": "markets",
      "links": { ... },
      "attributes": { ... },
      "relationships": { ... },
      "meta": { ... }
    },
    {
      "id": "kdPgtRXOKL",
      "type": "line_items",
      "links": { ... },
      "attributes": { ... },
      "relationships": { ... },
      "meta": { ... }
    },
    {
      "id": "XGZwpOSrWL",
      "type": "skus",
      "links": { ... },
      "attributes": { ... },
      "relationships": { ... },
      "meta": { ... }
    }
    {
      "id": "BgnguJvXmb",
      "type": "addresses",
      "links": { ... },
      "attributes": { ... },
      "relationships": { ... },
      "meta": { ... }
    },
    {
      "id": "AlrkugwyVW",
      "type": "addresses",
      "links": { ... },
      "attributes": { ... },
      "relationships": { ... },
      "meta": { ... }
    },
    {
      "id": "FdefrQxCba",
      "type": "shipments",
      "links": { ... },
      "attributes": { ... },
      "relationships": { ... },
      "meta": { ... }
    },
    {
      "id": "SfdyHtjfBF",
      "type": "shipping_methods",
      "links": { ... },
      "attributes": { ... },
      "relationships": { ... },
      "meta": { ... }
    },
    { ... }
  ]
}

Response

Your service response (or error) must match the format described in the example below.

Remember to pass the attribute-specific errors within the data object, associating them with the related order's attribute. If some error is not associated with any particular attribute use the base key (automatically filled with the error messages associated with any invalid attribute, if present).

Example

The successful response must be a JSON object, returning an empty body, meaning that the external logic running the validation has found no errors:

{
  "success": true,
  "data": {}
}

On error, you must respond with an HTTP code >= 400. The response body must be a JSON object containing the names of the order's attributes that generated the error(s) and one (a string) or more (an array) associated error message(s) as the value of the data key, plus any other relevant error code and message as the value of the error key:

{
  "success": false,
  "data": {
    "line_items": ["must be at least 3", "cannot weight more than 2000gr"],
    "shipping_address": "is not recognized by our geo-location service",
    "base": "standard error"
  },
  "error": {
    "code": "YOUR-ERROR-CODE",
    "message": "Your error message"
  }
}

Security

When you activate external validation, a shared secret is generated at the market level. We recommend verifying the callback authenticity by signing the payload with that shared secret and comparing the result with the callback signature header.

If the external validation fails the API responds to the PATCH above with a 422 error, showing the message(s) that your logic has returned. Please note that the order is not marked as invalid and can still be placed (in case it passes the standard, automatic validation at the time of placement). External validation errors are stored (until order approval) in which cannot be fetched by a sales channel (e.g. directly from the customer), so it's up to the client side to warn customers about them.

The request payload is a -compliant object you can query to perform your own computation. Aside from the target resource — order in this specific case — some relationships are also included to avoid useless API roundtrips:

In case the call to your external endpoint goes timeout, responds with an internal server error, or is blocked by the open , the API keeps responding with a 200 OK status code. No validation errors are attached to the order, but the validations_count value and the circuit breaker internal counter (if closed) are incremented.

JSON:API
Callbacks security
market
update
resource errors
circuit breaker