{
  "info": {
    "_postman_id": "03fb34a0-5ed8-4bef-859b-613b29bd2933",
    "name": "PEPTPlus Partner API (2026-10-29)",
    "description": "The PEPTPlus Partner API lets provider practices read the prescribable catalog and track orders,\nlets pharmacies run fulfillment and manage their catalog (products, lots, certificates of analysis),\nand lets labs read their API listings and licensees. Every organization can register webhook endpoints.\n\nAuthentication: `Authorization: Bearer sk_<org>_<env>_<48 hex>` where org is prov, pharm or lab and env is\nlive or test. Keys are minted in the portal account pages. Live keys require an active organization with a\nBusiness Associate Agreement on file (pharmacies also need a plan; the base plan is free). The sandbox at\ndemo.pept.plus mints test keys only and holds synthetic data.\n\nEvery response carries `X-Request-Id` and `X-API-Version`; authenticated responses add the `X-RateLimit-*`\nheaders. Errors use one envelope: `{ \"error\": { \"type\", \"message\", \"request_id\", ... } }`. Unknown paths\nunder /api/v1 return that envelope with type `not_found` (HTTP 404), never an HTML page.\n\nDedicated hosts: https://api.pept.plus/v1 (production) and https://sandbox.api.pept.plus/v1 (sandbox) are\nplanned and will serve the same routes with /v1 in place of /api/v1 once the DNS bindings are live.\n\nPrescription writes are deferred until EPCS certification: a controlled prescription must be signed by the\nprescriber with their own two-factor credential inside the certified application, which an API key that\nidentifies a server cannot do.\n\nSet the collection variables base_url (production https://pept.plus/api/v1, sandbox https://demo.pept.plus/api/v1) and api_key.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "auth": {
    "type": "bearer",
    "bearer": [
      {
        "key": "token",
        "value": "{{api_key}}",
        "type": "string"
      }
    ]
  },
  "variable": [
    {
      "key": "base_url",
      "value": "https://demo.pept.plus/api/v1",
      "type": "string"
    },
    {
      "key": "api_key",
      "value": "",
      "type": "string"
    }
  ],
  "item": [
    {
      "name": "Catalog",
      "description": "Prescribable compounds visible to the calling organization.",
      "item": [
        {
          "name": "List prescribable compounds",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/catalog?limit=25&starting_after=",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "catalog"
              ],
              "query": [
                {
                  "key": "limit",
                  "value": "25",
                  "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                  "disabled": true
                },
                {
                  "key": "starting_after",
                  "value": "",
                  "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                  "disabled": true
                }
              ]
            },
            "description": "Compounds the calling organization can prescribe or list, with their strengths, routes and eligibility basis. Only compounds marked prescribable in the eligibility register are returned. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
          },
          "response": [
            {
              "name": "200 A page of compounds",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Compounds the calling organization can prescribe or list, with their strengths, routes and eligibility basis. Only compounds marked prescribable in the eligibility register are returned. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "A page of compounds",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"object\": \"list\",\n  \"data\": [\n    {\n      \"id\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n      \"object\": \"compound\",\n      \"name\": \"BPC-157\",\n      \"eligibility_basis\": \"503A\",\n      \"strengths\": [\n        \"5 mg\"\n      ],\n      \"routes\": [\n        \"subq\"\n      ],\n      \"doses\": [\n        {\n          \"value\": \"5\",\n          \"unit\": \"mg\"\n        }\n      ]\n    }\n  ],\n  \"has_more\": false\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Compounds the calling organization can prescribe or list, with their strengths, routes and eligibility basis. Only compounds marked prescribable in the eligibility register are returned. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Compounds the calling organization can prescribe or list, with their strengths, routes and eligibility basis. Only compounds marked prescribable in the eligibility register are returned. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Compounds the calling organization can prescribe or list, with their strengths, routes and eligibility basis. Only compounds marked prescribable in the eligibility register are returned. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Compounds the calling organization can prescribe or list, with their strengths, routes and eligibility basis. Only compounds marked prescribable in the eligibility register are returned. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Retrieve a compound",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/catalog/:id",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "catalog",
                ":id"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "One compound by cmp_ id. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
          },
          "response": [
            {
              "name": "200 The compound",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One compound by cmp_ id. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "The compound",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"object\": \"compound\",\n  \"name\": \"BPC-157\",\n  \"eligibility_basis\": \"503A\",\n  \"strengths\": [\n    \"5 mg\"\n  ],\n  \"routes\": [\n    \"subq\"\n  ],\n  \"doses\": [\n    {\n      \"value\": \"5\",\n      \"unit\": \"mg\"\n    }\n  ]\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One compound by cmp_ id. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One compound by cmp_ id. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One compound by cmp_ id. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/catalog/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "catalog",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One compound by cmp_ id. Requires scope `catalog:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        }
      ]
    },
    {
      "name": "Orders",
      "description": "Orders visible to the calling organization (provider or pharmacy).",
      "item": [
        {
          "name": "List orders",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/orders?status=created&limit=25&starting_after=",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "orders"
              ],
              "query": [
                {
                  "key": "status",
                  "value": "created",
                  "description": "Filter by order status. Unknown values return 422.",
                  "disabled": true
                },
                {
                  "key": "limit",
                  "value": "25",
                  "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                  "disabled": true
                },
                {
                  "key": "starting_after",
                  "value": "",
                  "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                  "disabled": true
                }
              ]
            },
            "description": "Orders visible to the calling organization: a provider key sees orders for its prescriptions, a pharmacy key sees orders routed to it. Reads are audited as patient-bearing (count only, no PHI). Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
          },
          "response": [
            {
              "name": "200 A page of orders, newest first",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders visible to the calling organization: a provider key sees orders for its prescriptions, a pharmacy key sees orders routed to it. Reads are audited as patient-bearing (count only, no PHI). Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "A page of orders, newest first",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"object\": \"list\",\n  \"data\": [\n    {\n      \"id\": \"ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e\",\n      \"object\": \"order\",\n      \"status\": \"shipped\",\n      \"channel\": \"web\",\n      \"patient\": \"pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8\",\n      \"compound\": \"BPC-157\",\n      \"strength\": {\n        \"value\": \"5\",\n        \"unit\": \"mg\"\n      },\n      \"route\": \"subq\",\n      \"amount\": {\n        \"patient_paid_cents\": 14900,\n        \"platform_fee_cents\": 0,\n        \"currency\": \"usd\"\n      },\n      \"shipment\": {\n        \"carrier\": \"USPS\",\n        \"tracking_no\": \"9400100000000000000000\",\n        \"status\": \"in_transit\"\n      },\n      \"created_at\": \"2026-10-28T17:02:11.000Z\",\n      \"updated_at\": \"2026-10-29T14:30:00.000Z\"\n    }\n  ],\n  \"has_more\": true\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders visible to the calling organization: a provider key sees orders for its prescriptions, a pharmacy key sees orders routed to it. Reads are audited as patient-bearing (count only, no PHI). Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders visible to the calling organization: a provider key sees orders for its prescriptions, a pharmacy key sees orders routed to it. Reads are audited as patient-bearing (count only, no PHI). Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders visible to the calling organization: a provider key sees orders for its prescriptions, a pharmacy key sees orders routed to it. Reads are audited as patient-bearing (count only, no PHI). Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders visible to the calling organization: a provider key sees orders for its prescriptions, a pharmacy key sees orders routed to it. Reads are audited as patient-bearing (count only, no PHI). Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Retrieve an order",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/orders/:id",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "orders",
                ":id"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "One order with its latest shipment. The read is audited with the order id and patient token. Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
          },
          "response": [
            {
              "name": "200 The order",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One order with its latest shipment. The read is audited with the order id and patient token. Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "The order",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e\",\n  \"object\": \"order\",\n  \"status\": \"shipped\",\n  \"channel\": \"web\",\n  \"patient\": \"pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8\",\n  \"compound\": \"BPC-157\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"route\": \"subq\",\n  \"amount\": {\n    \"patient_paid_cents\": 14900,\n    \"platform_fee_cents\": 0,\n    \"currency\": \"usd\"\n  },\n  \"shipment\": {\n    \"carrier\": \"USPS\",\n    \"tracking_no\": \"9400100000000000000000\",\n    \"status\": \"in_transit\"\n  },\n  \"created_at\": \"2026-10-28T17:02:11.000Z\",\n  \"updated_at\": \"2026-10-29T14:30:00.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One order with its latest shipment. The read is audited with the order id and patient token. Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One order with its latest shipment. The read is audited with the order id and patient token. Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One order with its latest shipment. The read is audited with the order id and patient token. Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/orders/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "orders",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One order with its latest shipment. The read is audited with the order id and patient token. Requires scope `orders:read`. Allowed org types: provider_practice, pharmacy."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        }
      ]
    },
    {
      "name": "Pharmacy fulfillment",
      "description": "The pharmacy fulfillment queue: accept, set status, post shipment.",
      "item": [
        {
          "name": "List the fulfillment queue",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/orders?status=created&limit=25&starting_after=",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "orders"
              ],
              "query": [
                {
                  "key": "status",
                  "value": "created",
                  "description": "Filter by order status. Unknown values return 422.",
                  "disabled": true
                },
                {
                  "key": "limit",
                  "value": "25",
                  "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                  "disabled": true
                },
                {
                  "key": "starting_after",
                  "value": "",
                  "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                  "disabled": true
                }
              ]
            },
            "description": "Orders routed to the calling pharmacy, newest first. Same shape as GET /orders. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy."
          },
          "response": [
            {
              "name": "200 A page of orders",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders routed to the calling pharmacy, newest first. Same shape as GET /orders. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy."
              },
              "status": "A page of orders",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"object\": \"list\",\n  \"data\": [\n    {\n      \"id\": \"ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e\",\n      \"object\": \"order\",\n      \"status\": \"paid\",\n      \"channel\": \"web\",\n      \"patient\": \"pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8\",\n      \"compound\": \"BPC-157\",\n      \"strength\": {\n        \"value\": \"5\",\n        \"unit\": \"mg\"\n      },\n      \"route\": \"subq\",\n      \"amount\": {\n        \"patient_paid_cents\": 14900,\n        \"platform_fee_cents\": 0,\n        \"currency\": \"usd\"\n      },\n      \"shipment\": null,\n      \"created_at\": \"2026-10-28T17:02:11.000Z\",\n      \"updated_at\": \"2026-10-29T14:30:00.000Z\"\n    }\n  ],\n  \"has_more\": false\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders routed to the calling pharmacy, newest first. Same shape as GET /orders. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders routed to the calling pharmacy, newest first. Same shape as GET /orders. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy."
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders routed to the calling pharmacy, newest first. Same shape as GET /orders. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders?status=created&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders"
                  ],
                  "query": [
                    {
                      "key": "status",
                      "value": "created",
                      "description": "Filter by order status. Unknown values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Orders routed to the calling pharmacy, newest first. Same shape as GET /orders. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Accept an order",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              },
              {
                "key": "Idempotency-Key",
                "value": "{{$guid}}",
                "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/orders/:id/accept",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "orders",
                ":id",
                "accept"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "Acknowledge a routed order: the status moves to in_fulfillment. Empty body. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
          },
          "response": [
            {
              "name": "200 The updated order",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/accept",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "accept"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Acknowledge a routed order: the status moves to in_fulfillment. Empty body. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "The updated order",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e\",\n  \"object\": \"order\",\n  \"status\": \"in_fulfillment\",\n  \"channel\": \"web\",\n  \"patient\": \"pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8\",\n  \"compound\": \"BPC-157\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"route\": \"subq\",\n  \"amount\": {\n    \"patient_paid_cents\": 14900,\n    \"platform_fee_cents\": 0,\n    \"currency\": \"usd\"\n  },\n  \"shipment\": null,\n  \"created_at\": \"2026-10-28T17:02:11.000Z\",\n  \"updated_at\": \"2026-10-29T14:30:00.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/accept",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "accept"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Acknowledge a routed order: the status moves to in_fulfillment. Empty body. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/accept",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "accept"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Acknowledge a routed order: the status moves to in_fulfillment. Empty body. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/accept",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "accept"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Acknowledge a routed order: the status moves to in_fulfillment. Empty body. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/accept",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "accept"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Acknowledge a routed order: the status moves to in_fulfillment. Empty body. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/accept",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "accept"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Acknowledge a routed order: the status moves to in_fulfillment. Empty body. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Set an order status",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              },
              {
                "key": "Idempotency-Key",
                "value": "{{$guid}}",
                "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/orders/:id/status",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "orders",
                ":id",
                "status"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "Move the order to one of the pharmacy-settable statuses: in_fulfillment, shipped, delivered or action_needed. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"status\": \"delivered\"\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            }
          },
          "response": [
            {
              "name": "200 The updated order",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/status",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "status"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Move the order to one of the pharmacy-settable statuses: in_fulfillment, shipped, delivered or action_needed. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"status\": \"delivered\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The updated order",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e\",\n  \"object\": \"order\",\n  \"status\": \"delivered\",\n  \"channel\": \"web\",\n  \"patient\": \"pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8\",\n  \"compound\": \"BPC-157\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"route\": \"subq\",\n  \"amount\": {\n    \"patient_paid_cents\": 14900,\n    \"platform_fee_cents\": 0,\n    \"currency\": \"usd\"\n  },\n  \"shipment\": {\n    \"carrier\": \"USPS\",\n    \"tracking_no\": \"9400100000000000000000\",\n    \"status\": \"in_transit\"\n  },\n  \"created_at\": \"2026-10-28T17:02:11.000Z\",\n  \"updated_at\": \"2026-10-29T14:30:00.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/status",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "status"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Move the order to one of the pharmacy-settable statuses: in_fulfillment, shipped, delivered or action_needed. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"status\": \"delivered\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/status",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "status"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Move the order to one of the pharmacy-settable statuses: in_fulfillment, shipped, delivered or action_needed. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"status\": \"delivered\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/status",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "status"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Move the order to one of the pharmacy-settable statuses: in_fulfillment, shipped, delivered or action_needed. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"status\": \"delivered\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/status",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "status"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Move the order to one of the pharmacy-settable statuses: in_fulfillment, shipped, delivered or action_needed. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"status\": \"delivered\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/status",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "status"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Move the order to one of the pharmacy-settable statuses: in_fulfillment, shipped, delivered or action_needed. A controlled order whose prescription fails signature or DEA verification, or that is blocked on transmission, is refused with 422 validation_error. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"status\": \"delivered\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Record a shipment",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              },
              {
                "key": "Idempotency-Key",
                "value": "{{$guid}}",
                "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/orders/:id/shipment",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "orders",
                ":id",
                "shipment"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "Record the carrier and tracking number. The shipment is stored and the order advances to shipped. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"carrier\": \"USPS\",\n  \"tracking_no\": \"9400100000000000000000\"\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            }
          },
          "response": [
            {
              "name": "200 The updated order with the shipment embedded",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/shipment",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "shipment"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Record the carrier and tracking number. The shipment is stored and the order advances to shipped. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"carrier\": \"USPS\",\n  \"tracking_no\": \"9400100000000000000000\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The updated order with the shipment embedded",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e\",\n  \"object\": \"order\",\n  \"status\": \"shipped\",\n  \"channel\": \"web\",\n  \"patient\": \"pt_8f3a1b2c-4d5e-4f60-a1b2-c3d4e5f6a7b8\",\n  \"compound\": \"BPC-157\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"route\": \"subq\",\n  \"amount\": {\n    \"patient_paid_cents\": 14900,\n    \"platform_fee_cents\": 0,\n    \"currency\": \"usd\"\n  },\n  \"shipment\": {\n    \"carrier\": \"USPS\",\n    \"tracking_no\": \"9400100000000000000000\",\n    \"status\": \"in_transit\"\n  },\n  \"created_at\": \"2026-10-28T17:02:11.000Z\",\n  \"updated_at\": \"2026-10-29T14:30:00.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/shipment",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "shipment"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Record the carrier and tracking number. The shipment is stored and the order advances to shipped. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"carrier\": \"USPS\",\n  \"tracking_no\": \"9400100000000000000000\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/shipment",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "shipment"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Record the carrier and tracking number. The shipment is stored and the order advances to shipped. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"carrier\": \"USPS\",\n  \"tracking_no\": \"9400100000000000000000\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/shipment",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "shipment"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Record the carrier and tracking number. The shipment is stored and the order advances to shipped. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"carrier\": \"USPS\",\n  \"tracking_no\": \"9400100000000000000000\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/shipment",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "shipment"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Record the carrier and tracking number. The shipment is stored and the order advances to shipped. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"carrier\": \"USPS\",\n  \"tracking_no\": \"9400100000000000000000\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/orders/:id/shipment",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "orders",
                    ":id",
                    "shipment"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Record the carrier and tracking number. The shipment is stored and the order advances to shipped. Requires scope `pharmacy:fulfill`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"carrier\": \"USPS\",\n  \"tracking_no\": \"9400100000000000000000\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        }
      ]
    },
    {
      "name": "Pharmacy catalog",
      "description": "A pharmacy's own products, lots and certificates of analysis.",
      "item": [
        {
          "name": "List your products",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/products?channel=patient_rx&status=live&limit=25&starting_after=",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "products"
              ],
              "query": [
                {
                  "key": "channel",
                  "value": "patient_rx",
                  "description": "",
                  "disabled": true
                },
                {
                  "key": "status",
                  "value": "live",
                  "description": "",
                  "disabled": true
                },
                {
                  "key": "limit",
                  "value": "25",
                  "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                  "disabled": true
                },
                {
                  "key": "starting_after",
                  "value": "",
                  "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                  "disabled": true
                }
              ]
            },
            "description": "The pharmacy's own listings across both channels. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
          },
          "response": [
            {
              "name": "200 A page of products",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products?channel=patient_rx&status=live&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ],
                  "query": [
                    {
                      "key": "channel",
                      "value": "patient_rx",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "status",
                      "value": "live",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The pharmacy's own listings across both channels. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "A page of products",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"object\": \"list\",\n  \"data\": [\n    {\n      \"id\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n      \"object\": \"product\",\n      \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n      \"name\": \"BPC-157\",\n      \"channel\": \"patient_rx\",\n      \"status\": \"live\",\n      \"published\": true,\n      \"delivery_method\": \"subq\",\n      \"strength\": {\n        \"value\": \"5\",\n        \"unit\": \"mg\"\n      },\n      \"dosage_form_code\": \"C42945\",\n      \"quantity_uom_code\": \"C48542\",\n      \"pricing\": {\n        \"patient_price\": \"149.00\",\n        \"price_basis\": \"per_rx\",\n        \"currency\": \"usd\"\n      },\n      \"latest_batch\": {\n        \"id\": \"bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n        \"lot_no\": \"L-2041\",\n        \"quantity\": 120,\n        \"expiry_date\": \"2027-03-01\",\n        \"coa_status\": \"on_file\"\n      },\n      \"created_at\": \"2026-10-01T15:00:00.000Z\",\n      \"updated_at\": \"2026-10-20T09:12:00.000Z\"\n    }\n  ],\n  \"has_more\": false\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products?channel=patient_rx&status=live&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ],
                  "query": [
                    {
                      "key": "channel",
                      "value": "patient_rx",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "status",
                      "value": "live",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The pharmacy's own listings across both channels. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products?channel=patient_rx&status=live&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ],
                  "query": [
                    {
                      "key": "channel",
                      "value": "patient_rx",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "status",
                      "value": "live",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The pharmacy's own listings across both channels. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products?channel=patient_rx&status=live&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ],
                  "query": [
                    {
                      "key": "channel",
                      "value": "patient_rx",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "status",
                      "value": "live",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The pharmacy's own listings across both channels. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products?channel=patient_rx&status=live&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ],
                  "query": [
                    {
                      "key": "channel",
                      "value": "patient_rx",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "status",
                      "value": "live",
                      "description": "",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The pharmacy's own listings across both channels. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Create a product",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              },
              {
                "key": "Idempotency-Key",
                "value": "{{$guid}}",
                "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/products",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "products"
              ]
            },
            "description": "Add a listing for a compound from GET /catalog. The product is created pending review and goes live after PEPTPlus verification; published false saves a draft instead. A patient_rx product needs patient_price; an office_stock product needs pack_size, wholesale_price and lead_time_days. A compound that is not prescribable through the chosen channel returns 422. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"channel\": \"patient_rx\",\n  \"delivery_method\": \"subq\",\n  \"strength\": {\n    \"value\": 5,\n    \"unit\": \"mg\"\n  },\n  \"dosage_form_code\": \"C42945\",\n  \"quantity_uom_code\": \"C48542\",\n  \"patient_price\": 149,\n  \"price_basis\": \"per_rx\",\n  \"batch\": {\n    \"lot_no\": \"L-2041\",\n    \"quantity\": 120,\n    \"expiry_date\": \"2027-03-01\"\n  }\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            }
          },
          "response": [
            {
              "name": "201 The created product",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ]
                },
                "description": "Add a listing for a compound from GET /catalog. The product is created pending review and goes live after PEPTPlus verification; published false saves a draft instead. A patient_rx product needs patient_price; an office_stock product needs pack_size, wholesale_price and lead_time_days. A compound that is not prescribable through the chosen channel returns 422. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"channel\": \"patient_rx\",\n  \"delivery_method\": \"subq\",\n  \"strength\": {\n    \"value\": 5,\n    \"unit\": \"mg\"\n  },\n  \"dosage_form_code\": \"C42945\",\n  \"quantity_uom_code\": \"C48542\",\n  \"patient_price\": 149,\n  \"price_basis\": \"per_rx\",\n  \"batch\": {\n    \"lot_no\": \"L-2041\",\n    \"quantity\": 120,\n    \"expiry_date\": \"2027-03-01\"\n  }\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The created product",
              "code": 201,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"object\": \"product\",\n  \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"name\": \"BPC-157\",\n  \"channel\": \"patient_rx\",\n  \"status\": \"pending_review\",\n  \"published\": true,\n  \"delivery_method\": \"subq\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"dosage_form_code\": \"C42945\",\n  \"quantity_uom_code\": \"C48542\",\n  \"pricing\": {\n    \"patient_price\": \"149.00\",\n    \"price_basis\": \"per_rx\",\n    \"currency\": \"usd\"\n  },\n  \"latest_batch\": {\n    \"id\": \"bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n    \"lot_no\": \"L-2041\",\n    \"quantity\": 120,\n    \"expiry_date\": \"2027-03-01\",\n    \"coa_status\": \"on_file\"\n  },\n  \"created_at\": \"2026-10-01T15:00:00.000Z\",\n  \"updated_at\": \"2026-10-20T09:12:00.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ]
                },
                "description": "Add a listing for a compound from GET /catalog. The product is created pending review and goes live after PEPTPlus verification; published false saves a draft instead. A patient_rx product needs patient_price; an office_stock product needs pack_size, wholesale_price and lead_time_days. A compound that is not prescribable through the chosen channel returns 422. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"channel\": \"patient_rx\",\n  \"delivery_method\": \"subq\",\n  \"strength\": {\n    \"value\": 5,\n    \"unit\": \"mg\"\n  },\n  \"dosage_form_code\": \"C42945\",\n  \"quantity_uom_code\": \"C48542\",\n  \"patient_price\": 149,\n  \"price_basis\": \"per_rx\",\n  \"batch\": {\n    \"lot_no\": \"L-2041\",\n    \"quantity\": 120,\n    \"expiry_date\": \"2027-03-01\"\n  }\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ]
                },
                "description": "Add a listing for a compound from GET /catalog. The product is created pending review and goes live after PEPTPlus verification; published false saves a draft instead. A patient_rx product needs patient_price; an office_stock product needs pack_size, wholesale_price and lead_time_days. A compound that is not prescribable through the chosen channel returns 422. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"channel\": \"patient_rx\",\n  \"delivery_method\": \"subq\",\n  \"strength\": {\n    \"value\": 5,\n    \"unit\": \"mg\"\n  },\n  \"dosage_form_code\": \"C42945\",\n  \"quantity_uom_code\": \"C48542\",\n  \"patient_price\": 149,\n  \"price_basis\": \"per_rx\",\n  \"batch\": {\n    \"lot_no\": \"L-2041\",\n    \"quantity\": 120,\n    \"expiry_date\": \"2027-03-01\"\n  }\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ]
                },
                "description": "Add a listing for a compound from GET /catalog. The product is created pending review and goes live after PEPTPlus verification; published false saves a draft instead. A patient_rx product needs patient_price; an office_stock product needs pack_size, wholesale_price and lead_time_days. A compound that is not prescribable through the chosen channel returns 422. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"channel\": \"patient_rx\",\n  \"delivery_method\": \"subq\",\n  \"strength\": {\n    \"value\": 5,\n    \"unit\": \"mg\"\n  },\n  \"dosage_form_code\": \"C42945\",\n  \"quantity_uom_code\": \"C48542\",\n  \"patient_price\": 149,\n  \"price_basis\": \"per_rx\",\n  \"batch\": {\n    \"lot_no\": \"L-2041\",\n    \"quantity\": 120,\n    \"expiry_date\": \"2027-03-01\"\n  }\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products"
                  ]
                },
                "description": "Add a listing for a compound from GET /catalog. The product is created pending review and goes live after PEPTPlus verification; published false saves a draft instead. A patient_rx product needs patient_price; an office_stock product needs pack_size, wholesale_price and lead_time_days. A compound that is not prescribable through the chosen channel returns 422. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"channel\": \"patient_rx\",\n  \"delivery_method\": \"subq\",\n  \"strength\": {\n    \"value\": 5,\n    \"unit\": \"mg\"\n  },\n  \"dosage_form_code\": \"C42945\",\n  \"quantity_uom_code\": \"C48542\",\n  \"patient_price\": 149,\n  \"price_basis\": \"per_rx\",\n  \"batch\": {\n    \"lot_no\": \"L-2041\",\n    \"quantity\": 120,\n    \"expiry_date\": \"2027-03-01\"\n  }\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Retrieve a product",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/products/:id",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "products",
                ":id"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "One of the pharmacy's products by prd_ id. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
          },
          "response": [
            {
              "name": "200 The product",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One of the pharmacy's products by prd_ id. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "The product",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"object\": \"product\",\n  \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"name\": \"BPC-157\",\n  \"channel\": \"patient_rx\",\n  \"status\": \"live\",\n  \"published\": true,\n  \"delivery_method\": \"subq\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"dosage_form_code\": \"C42945\",\n  \"quantity_uom_code\": \"C48542\",\n  \"pricing\": {\n    \"patient_price\": \"149.00\",\n    \"price_basis\": \"per_rx\",\n    \"currency\": \"usd\"\n  },\n  \"latest_batch\": {\n    \"id\": \"bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n    \"lot_no\": \"L-2041\",\n    \"quantity\": 120,\n    \"expiry_date\": \"2027-03-01\",\n    \"coa_status\": \"on_file\"\n  },\n  \"created_at\": \"2026-10-01T15:00:00.000Z\",\n  \"updated_at\": \"2026-10-20T09:12:00.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One of the pharmacy's products by prd_ id. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One of the pharmacy's products by prd_ id. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One of the pharmacy's products by prd_ id. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One of the pharmacy's products by prd_ id. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Update a product",
          "request": {
            "method": "PATCH",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              },
              {
                "key": "Idempotency-Key",
                "value": "{{$guid}}",
                "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/products/:id",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "products",
                ":id"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "Change pricing, availability or form fields. published true shows an approved product in the marketplace and false unlists it. Changing delivery_method on an approved product sends it back for review; the response says so in sent_to_review. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"patient_price\": \"159.00\",\n  \"published\": true\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            }
          },
          "response": [
            {
              "name": "200 The updated product",
              "originalRequest": {
                "method": "PATCH",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Change pricing, availability or form fields. published true shows an approved product in the marketplace and false unlists it. Changing delivery_method on an approved product sends it back for review; the response says so in sent_to_review. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"patient_price\": \"159.00\",\n  \"published\": true\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The updated product",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"object\": \"product\",\n  \"compound\": \"cmp_5f2c7a10-3b4e-4d6f-9a8b-1c2d3e4f5a6b\",\n  \"name\": \"BPC-157\",\n  \"channel\": \"patient_rx\",\n  \"status\": \"live\",\n  \"published\": true,\n  \"delivery_method\": \"subq\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"dosage_form_code\": \"C42945\",\n  \"quantity_uom_code\": \"C48542\",\n  \"pricing\": {\n    \"patient_price\": \"159.00\",\n    \"price_basis\": \"per_rx\",\n    \"currency\": \"usd\"\n  },\n  \"latest_batch\": {\n    \"id\": \"bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n    \"lot_no\": \"L-2041\",\n    \"quantity\": 120,\n    \"expiry_date\": \"2027-03-01\",\n    \"coa_status\": \"on_file\"\n  },\n  \"created_at\": \"2026-10-01T15:00:00.000Z\",\n  \"updated_at\": \"2026-10-20T09:12:00.000Z\",\n  \"sent_to_review\": false\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "PATCH",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Change pricing, availability or form fields. published true shows an approved product in the marketplace and false unlists it. Changing delivery_method on an approved product sends it back for review; the response says so in sent_to_review. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"patient_price\": \"159.00\",\n  \"published\": true\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "PATCH",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Change pricing, availability or form fields. published true shows an approved product in the marketplace and false unlists it. Changing delivery_method on an approved product sends it back for review; the response says so in sent_to_review. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"patient_price\": \"159.00\",\n  \"published\": true\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "PATCH",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Change pricing, availability or form fields. published true shows an approved product in the marketplace and false unlists it. Changing delivery_method on an approved product sends it back for review; the response says so in sent_to_review. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"patient_price\": \"159.00\",\n  \"published\": true\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "PATCH",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Change pricing, availability or form fields. published true shows an approved product in the marketplace and false unlists it. Changing delivery_method on an approved product sends it back for review; the response says so in sent_to_review. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"patient_price\": \"159.00\",\n  \"published\": true\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "PATCH",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/products/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "products",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Change pricing, availability or form fields. published true shows an approved product in the marketplace and false unlists it. Changing delivery_method on an approved product sends it back for review; the response says so in sent_to_review. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"patient_price\": \"159.00\",\n  \"published\": true\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "List lots",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/batches?product=&limit=25&starting_after=",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "batches"
              ],
              "query": [
                {
                  "key": "product",
                  "value": "",
                  "description": "Only lots of this prd_ id.",
                  "disabled": true
                },
                {
                  "key": "limit",
                  "value": "25",
                  "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                  "disabled": true
                },
                {
                  "key": "starting_after",
                  "value": "",
                  "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                  "disabled": true
                }
              ]
            },
            "description": "Lots (batches) across the pharmacy's products, each with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
          },
          "response": [
            {
              "name": "200 A page of lots",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches?product=&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ],
                  "query": [
                    {
                      "key": "product",
                      "value": "",
                      "description": "Only lots of this prd_ id.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Lots (batches) across the pharmacy's products, each with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "A page of lots",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"object\": \"list\",\n  \"data\": [\n    {\n      \"id\": \"bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n      \"object\": \"batch\",\n      \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n      \"compound\": \"BPC-157\",\n      \"strength\": {\n        \"value\": \"5\",\n        \"unit\": \"mg\"\n      },\n      \"lot_no\": \"L-2041\",\n      \"quantity\": 120,\n      \"mfg_date\": \"2026-09-15\",\n      \"expiry_date\": \"2027-03-01\",\n      \"coa\": {\n        \"id\": \"coa_2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f\",\n        \"object\": \"coa\",\n        \"status\": \"on_file\",\n        \"purity_pct\": \"99.2\",\n        \"lab_name\": \"Janoshik\",\n        \"tested_on\": \"2026-09-20\",\n        \"uploaded_at\": \"2026-10-02T11:00:00.000Z\"\n      },\n      \"created_at\": \"2026-10-01T15:00:00.000Z\"\n    }\n  ],\n  \"has_more\": false\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches?product=&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ],
                  "query": [
                    {
                      "key": "product",
                      "value": "",
                      "description": "Only lots of this prd_ id.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Lots (batches) across the pharmacy's products, each with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches?product=&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ],
                  "query": [
                    {
                      "key": "product",
                      "value": "",
                      "description": "Only lots of this prd_ id.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Lots (batches) across the pharmacy's products, each with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches?product=&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ],
                  "query": [
                    {
                      "key": "product",
                      "value": "",
                      "description": "Only lots of this prd_ id.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Lots (batches) across the pharmacy's products, each with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches?product=&limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ],
                  "query": [
                    {
                      "key": "product",
                      "value": "",
                      "description": "Only lots of this prd_ id.",
                      "disabled": true
                    },
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "Lots (batches) across the pharmacy's products, each with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Create a lot",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              },
              {
                "key": "Idempotency-Key",
                "value": "{{$guid}}",
                "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/batches",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "batches"
              ]
            },
            "description": "Add a lot to one of the pharmacy's products. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"lot_no\": \"L-2042\",\n  \"quantity\": 80,\n  \"mfg_date\": \"2026-10-10\",\n  \"expiry_date\": \"2027-04-01\"\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            }
          },
          "response": [
            {
              "name": "201 The created lot",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ]
                },
                "description": "Add a lot to one of the pharmacy's products. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"lot_no\": \"L-2042\",\n  \"quantity\": 80,\n  \"mfg_date\": \"2026-10-10\",\n  \"expiry_date\": \"2027-04-01\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The created lot",
              "code": 201,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n  \"object\": \"batch\",\n  \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"compound\": \"BPC-157\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"lot_no\": \"L-2042\",\n  \"quantity\": 120,\n  \"mfg_date\": \"2026-09-15\",\n  \"expiry_date\": \"2027-03-01\",\n  \"coa\": null,\n  \"created_at\": \"2026-10-01T15:00:00.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ]
                },
                "description": "Add a lot to one of the pharmacy's products. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"lot_no\": \"L-2042\",\n  \"quantity\": 80,\n  \"mfg_date\": \"2026-10-10\",\n  \"expiry_date\": \"2027-04-01\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ]
                },
                "description": "Add a lot to one of the pharmacy's products. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"lot_no\": \"L-2042\",\n  \"quantity\": 80,\n  \"mfg_date\": \"2026-10-10\",\n  \"expiry_date\": \"2027-04-01\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ]
                },
                "description": "Add a lot to one of the pharmacy's products. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"lot_no\": \"L-2042\",\n  \"quantity\": 80,\n  \"mfg_date\": \"2026-10-10\",\n  \"expiry_date\": \"2027-04-01\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches"
                  ]
                },
                "description": "Add a lot to one of the pharmacy's products. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"lot_no\": \"L-2042\",\n  \"quantity\": 80,\n  \"mfg_date\": \"2026-10-10\",\n  \"expiry_date\": \"2027-04-01\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Retrieve a lot",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/batches/:id",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "batches",
                ":id"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "One lot with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
          },
          "response": [
            {
              "name": "200 The lot",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One lot with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "The lot",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n  \"object\": \"batch\",\n  \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"compound\": \"BPC-157\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"lot_no\": \"L-2041\",\n  \"quantity\": 120,\n  \"mfg_date\": \"2026-09-15\",\n  \"expiry_date\": \"2027-03-01\",\n  \"coa\": {\n    \"id\": \"coa_2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f\",\n    \"object\": \"coa\",\n    \"status\": \"on_file\",\n    \"purity_pct\": \"99.2\",\n    \"lab_name\": \"Janoshik\",\n    \"tested_on\": \"2026-09-20\",\n    \"uploaded_at\": \"2026-10-02T11:00:00.000Z\"\n  },\n  \"created_at\": \"2026-10-01T15:00:00.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One lot with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One lot with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One lot with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One lot with its latest certificate of analysis. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Upload a certificate of analysis",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/pharmacy/batches/:id/coa",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "pharmacy",
                "batches",
                ":id",
                "coa"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "Attach a COA PDF (at most 15 MB) to a lot, as multipart/form-data with a `file` field or as JSON with `pdf_base64`. Purity, lab name and test date are stored as sent; nothing is parsed from the PDF. Idempotency-Key is not honored on this route. When file storage is not configured the route answers 503 with a flat `{ \"error\": \"storage_unavailable\", \"message\": ... }` body rather than the standard envelope. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"pdf_base64\": \"JVBERi0xLjQKJ...\",\n  \"purity_pct\": 99.2,\n  \"lab_name\": \"Janoshik\",\n  \"tested_on\": \"2026-09-20\"\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            }
          },
          "response": [
            {
              "name": "201 The lot with the new certificate",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id/coa",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id",
                    "coa"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Attach a COA PDF (at most 15 MB) to a lot, as multipart/form-data with a `file` field or as JSON with `pdf_base64`. Purity, lab name and test date are stored as sent; nothing is parsed from the PDF. Idempotency-Key is not honored on this route. When file storage is not configured the route answers 503 with a flat `{ \"error\": \"storage_unavailable\", \"message\": ... }` body rather than the standard envelope. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"pdf_base64\": \"JVBERi0xLjQKJ...\",\n  \"purity_pct\": 99.2,\n  \"lab_name\": \"Janoshik\",\n  \"tested_on\": \"2026-09-20\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The lot with the new certificate",
              "code": 201,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"bat_7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n  \"object\": \"batch\",\n  \"product\": \"prd_1d2e3f40-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n  \"compound\": \"BPC-157\",\n  \"strength\": {\n    \"value\": \"5\",\n    \"unit\": \"mg\"\n  },\n  \"lot_no\": \"L-2041\",\n  \"quantity\": 120,\n  \"mfg_date\": \"2026-09-15\",\n  \"expiry_date\": \"2027-03-01\",\n  \"coa\": {\n    \"id\": \"coa_2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f\",\n    \"object\": \"coa\",\n    \"status\": \"on_file\",\n    \"purity_pct\": \"99.2\",\n    \"lab_name\": \"Janoshik\",\n    \"tested_on\": \"2026-09-20\",\n    \"uploaded_at\": \"2026-10-02T11:00:00.000Z\"\n  },\n  \"created_at\": \"2026-10-01T15:00:00.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id/coa",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id",
                    "coa"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Attach a COA PDF (at most 15 MB) to a lot, as multipart/form-data with a `file` field or as JSON with `pdf_base64`. Purity, lab name and test date are stored as sent; nothing is parsed from the PDF. Idempotency-Key is not honored on this route. When file storage is not configured the route answers 503 with a flat `{ \"error\": \"storage_unavailable\", \"message\": ... }` body rather than the standard envelope. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"pdf_base64\": \"JVBERi0xLjQKJ...\",\n  \"purity_pct\": 99.2,\n  \"lab_name\": \"Janoshik\",\n  \"tested_on\": \"2026-09-20\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id/coa",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id",
                    "coa"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Attach a COA PDF (at most 15 MB) to a lot, as multipart/form-data with a `file` field or as JSON with `pdf_base64`. Purity, lab name and test date are stored as sent; nothing is parsed from the PDF. Idempotency-Key is not honored on this route. When file storage is not configured the route answers 503 with a flat `{ \"error\": \"storage_unavailable\", \"message\": ... }` body rather than the standard envelope. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"pdf_base64\": \"JVBERi0xLjQKJ...\",\n  \"purity_pct\": 99.2,\n  \"lab_name\": \"Janoshik\",\n  \"tested_on\": \"2026-09-20\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id/coa",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id",
                    "coa"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Attach a COA PDF (at most 15 MB) to a lot, as multipart/form-data with a `file` field or as JSON with `pdf_base64`. Purity, lab name and test date are stored as sent; nothing is parsed from the PDF. Idempotency-Key is not honored on this route. When file storage is not configured the route answers 503 with a flat `{ \"error\": \"storage_unavailable\", \"message\": ... }` body rather than the standard envelope. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"pdf_base64\": \"JVBERi0xLjQKJ...\",\n  \"purity_pct\": 99.2,\n  \"lab_name\": \"Janoshik\",\n  \"tested_on\": \"2026-09-20\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id/coa",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id",
                    "coa"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Attach a COA PDF (at most 15 MB) to a lot, as multipart/form-data with a `file` field or as JSON with `pdf_base64`. Purity, lab name and test date are stored as sent; nothing is parsed from the PDF. Idempotency-Key is not honored on this route. When file storage is not configured the route answers 503 with a flat `{ \"error\": \"storage_unavailable\", \"message\": ... }` body rather than the standard envelope. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"pdf_base64\": \"JVBERi0xLjQKJ...\",\n  \"purity_pct\": 99.2,\n  \"lab_name\": \"Janoshik\",\n  \"tested_on\": \"2026-09-20\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/pharmacy/batches/:id/coa",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "pharmacy",
                    "batches",
                    ":id",
                    "coa"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Attach a COA PDF (at most 15 MB) to a lot, as multipart/form-data with a `file` field or as JSON with `pdf_base64`. Purity, lab name and test date are stored as sent; nothing is parsed from the PDF. Idempotency-Key is not honored on this route. When file storage is not configured the route answers 503 with a flat `{ \"error\": \"storage_unavailable\", \"message\": ... }` body rather than the standard envelope. Requires scope `pharmacy:catalog`. Allowed org types: pharmacy.",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"pdf_base64\": \"JVBERi0xLjQKJ...\",\n  \"purity_pct\": 99.2,\n  \"lab_name\": \"Janoshik\",\n  \"tested_on\": \"2026-09-20\"\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        }
      ]
    },
    {
      "name": "Labs",
      "description": "A lab's API listings and the pharmacies licensing them.",
      "item": [
        {
          "name": "List your API listings",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/listings?limit=25&starting_after=",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "listings"
              ],
              "query": [
                {
                  "key": "limit",
                  "value": "25",
                  "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                  "disabled": true
                },
                {
                  "key": "starting_after",
                  "value": "",
                  "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                  "disabled": true
                }
              ]
            },
            "description": "The lab's own API listings with the count of pharmacies licensing each one. Requires scope `listings:read`. Allowed org types: lab."
          },
          "response": [
            {
              "name": "200 A page of listings",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The lab's own API listings with the count of pharmacies licensing each one. Requires scope `listings:read`. Allowed org types: lab."
              },
              "status": "A page of listings",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"object\": \"list\",\n  \"data\": [\n    {\n      \"id\": \"lst_3a91c0de-7f21-4b3a-9e55-0a1b2c3d4e5f\",\n      \"object\": \"listing\",\n      \"substance\": \"Sermorelin\",\n      \"monthly_fee\": \"499\",\n      \"currency\": \"usd\",\n      \"certified\": true,\n      \"eligibility_note\": null,\n      \"status\": \"active\",\n      \"licensee_count\": 4\n    }\n  ],\n  \"has_more\": false\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The lab's own API listings with the count of pharmacies licensing each one. Requires scope `listings:read`. Allowed org types: lab."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The lab's own API listings with the count of pharmacies licensing each one. Requires scope `listings:read`. Allowed org types: lab."
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The lab's own API listings with the count of pharmacies licensing each one. Requires scope `listings:read`. Allowed org types: lab."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings?limit=25&starting_after=",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings"
                  ],
                  "query": [
                    {
                      "key": "limit",
                      "value": "25",
                      "description": "Page size, 1 to 100 (default 25). Values above 100 are clamped to 100; zero, negative or non-integer values return 422.",
                      "disabled": true
                    },
                    {
                      "key": "starting_after",
                      "value": "",
                      "description": "Cursor: the id of the last item of the previous page (prefixed or bare UUID). Lists are ordered newest first by (created_at, id). An id that is not visible to the key returns 422.",
                      "disabled": true
                    }
                  ]
                },
                "description": "The lab's own API listings with the count of pharmacies licensing each one. Requires scope `listings:read`. Allowed org types: lab."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "List the licensees of a listing",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/listings/:id/licensees",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "listings",
                ":id",
                "licensees"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "Pharmacies licensing one of the lab's listings. Not paginated: the full list is returned without has_more, and limit and starting_after are ignored. 404 when the listing does not belong to the lab. Requires scope `licensees:read`. Allowed org types: lab."
          },
          "response": [
            {
              "name": "200 All licenses on the listing",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings/:id/licensees",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings",
                    ":id",
                    "licensees"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Pharmacies licensing one of the lab's listings. Not paginated: the full list is returned without has_more, and limit and starting_after are ignored. 404 when the listing does not belong to the lab. Requires scope `licensees:read`. Allowed org types: lab."
              },
              "status": "All licenses on the listing",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"object\": \"list\",\n  \"data\": [\n    {\n      \"id\": \"lic_0b7d2e4f-6a8c-4e1b-b3d5-7f9a1c3e5b7d\",\n      \"object\": \"license\",\n      \"pharmacy\": \"org_9e8d7c6b-5a4f-4e3d-2c1b-0a9f8e7d6c5b\",\n      \"status\": \"active\",\n      \"monthly_fee\": \"499\",\n      \"currency\": \"usd\",\n      \"started_at\": \"2026-09-01T00:00:00.000Z\",\n      \"canceled_at\": null\n    }\n  ]\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings/:id/licensees",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings",
                    ":id",
                    "licensees"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Pharmacies licensing one of the lab's listings. Not paginated: the full list is returned without has_more, and limit and starting_after are ignored. 404 when the listing does not belong to the lab. Requires scope `licensees:read`. Allowed org types: lab."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings/:id/licensees",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings",
                    ":id",
                    "licensees"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Pharmacies licensing one of the lab's listings. Not paginated: the full list is returned without has_more, and limit and starting_after are ignored. 404 when the listing does not belong to the lab. Requires scope `licensees:read`. Allowed org types: lab."
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings/:id/licensees",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings",
                    ":id",
                    "licensees"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Pharmacies licensing one of the lab's listings. Not paginated: the full list is returned without has_more, and limit and starting_after are ignored. 404 when the listing does not belong to the lab. Requires scope `licensees:read`. Allowed org types: lab."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/listings/:id/licensees",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "listings",
                    ":id",
                    "licensees"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Pharmacies licensing one of the lab's listings. Not paginated: the full list is returned without has_more, and limit and starting_after are ignored. 404 when the listing does not belong to the lab. Requires scope `licensees:read`. Allowed org types: lab."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        }
      ]
    },
    {
      "name": "Webhooks",
      "description": "Webhook endpoint management. The delivery contract is under the top-level `webhooks` object.",
      "item": [
        {
          "name": "List webhook endpoints",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/webhooks",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "webhooks"
              ]
            },
            "description": "The organization's registered endpoints. Not paginated: has_more is always false. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
          },
          "response": [
            {
              "name": "200 All endpoints",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks"
                  ]
                },
                "description": "The organization's registered endpoints. Not paginated: has_more is always false. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "All endpoints",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"object\": \"list\",\n  \"data\": [\n    {\n      \"id\": \"whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8\",\n      \"object\": \"webhook_endpoint\",\n      \"url\": \"https://example.com/peptplus/webhooks\",\n      \"description\": \"Pharmacy system, production\",\n      \"events\": [\n        \"order.created\",\n        \"order.status_changed\",\n        \"shipment.created\"\n      ],\n      \"active\": true,\n      \"disabled_reason\": null,\n      \"secret_hint\": \"9c4e\",\n      \"stats\": {\n        \"delivered\": 128,\n        \"failed\": 2,\n        \"consecutive_failures\": 0,\n        \"last_delivered_at\": \"2026-10-29T14:31:02.000Z\"\n      },\n      \"created_at\": \"2026-10-29T10:00:00.000Z\",\n      \"updated_at\": \"2026-10-29T14:31:02.000Z\"\n    }\n  ],\n  \"has_more\": false\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks"
                  ]
                },
                "description": "The organization's registered endpoints. Not paginated: has_more is always false. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks"
                  ]
                },
                "description": "The organization's registered endpoints. Not paginated: has_more is always false. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks"
                  ]
                },
                "description": "The organization's registered endpoints. Not paginated: has_more is always false. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Create a webhook endpoint",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              },
              {
                "key": "Idempotency-Key",
                "value": "{{$guid}}",
                "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/webhooks",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "webhooks"
              ]
            },
            "description": "Register an https endpoint for the given events. The response carries `secret` exactly once; store it. At most 10 endpoints per organization. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"url\": \"https://example.com/peptplus/webhooks\",\n  \"description\": \"Pharmacy system, production\",\n  \"events\": [\n    \"order.created\",\n    \"order.status_changed\",\n    \"shipment.created\"\n  ]\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            }
          },
          "response": [
            {
              "name": "201 The endpoint, with its signing secret",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks"
                  ]
                },
                "description": "Register an https endpoint for the given events. The response carries `secret` exactly once; store it. At most 10 endpoints per organization. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"url\": \"https://example.com/peptplus/webhooks\",\n  \"description\": \"Pharmacy system, production\",\n  \"events\": [\n    \"order.created\",\n    \"order.status_changed\",\n    \"shipment.created\"\n  ]\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The endpoint, with its signing secret",
              "code": 201,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8\",\n  \"object\": \"webhook_endpoint\",\n  \"url\": \"https://example.com/peptplus/webhooks\",\n  \"description\": \"Pharmacy system, production\",\n  \"events\": [\n    \"order.created\",\n    \"order.status_changed\",\n    \"shipment.created\"\n  ],\n  \"active\": true,\n  \"disabled_reason\": null,\n  \"secret_hint\": \"9c4e\",\n  \"stats\": {\n    \"delivered\": 0,\n    \"failed\": 0,\n    \"consecutive_failures\": 0,\n    \"last_delivered_at\": null\n  },\n  \"created_at\": \"2026-10-29T10:00:00.000Z\",\n  \"updated_at\": \"2026-10-29T14:31:02.000Z\",\n  \"secret\": \"whsec_0123456789abcdef0123456789abcdef0123456789ab9c4e\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks"
                  ]
                },
                "description": "Register an https endpoint for the given events. The response carries `secret` exactly once; store it. At most 10 endpoints per organization. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"url\": \"https://example.com/peptplus/webhooks\",\n  \"description\": \"Pharmacy system, production\",\n  \"events\": [\n    \"order.created\",\n    \"order.status_changed\",\n    \"shipment.created\"\n  ]\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "422 validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks"
                  ]
                },
                "description": "Register an https endpoint for the given events. The response carries `secret` exactly once; store it. At most 10 endpoints per organization. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"url\": \"https://example.com/peptplus/webhooks\",\n  \"description\": \"Pharmacy system, production\",\n  \"events\": [\n    \"order.created\",\n    \"order.status_changed\",\n    \"shipment.created\"\n  ]\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "validation_error for a bad body or query parameter (`details` carries field errors when a schema failed), or idempotency_error when an Idempotency-Key is reused with a different body",
              "code": 422,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"validation_error\",\n    \"message\": \"Invalid request body.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"details\": {\n      \"formErrors\": [],\n      \"fieldErrors\": {\n        \"carrier\": [\n          \"Required\"\n        ]\n      }\n    }\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks"
                  ]
                },
                "description": "Register an https endpoint for the given events. The response carries `secret` exactly once; store it. At most 10 endpoints per organization. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"url\": \"https://example.com/peptplus/webhooks\",\n  \"description\": \"Pharmacy system, production\",\n  \"events\": [\n    \"order.created\",\n    \"order.status_changed\",\n    \"shipment.created\"\n  ]\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "Content-Type",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks"
                  ]
                },
                "description": "Register an https endpoint for the given events. The response carries `secret` exactly once; store it. At most 10 endpoints per organization. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error).",
                "body": {
                  "mode": "raw",
                  "raw": "{\n  \"url\": \"https://example.com/peptplus/webhooks\",\n  \"description\": \"Pharmacy system, production\",\n  \"events\": [\n    \"order.created\",\n    \"order.status_changed\",\n    \"shipment.created\"\n  ]\n}",
                  "options": {
                    "raw": {
                      "language": "json"
                    }
                  }
                }
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Retrieve a webhook endpoint",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/webhooks/:id",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "webhooks",
                ":id"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "One endpoint with its 20 most recent deliveries. Poll this after POST /webhooks/{id}/test to see the ping result. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
          },
          "response": [
            {
              "name": "200 The endpoint and recent deliveries",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One endpoint with its 20 most recent deliveries. Poll this after POST /webhooks/{id}/test to see the ping result. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "The endpoint and recent deliveries",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8\",\n  \"object\": \"webhook_endpoint\",\n  \"url\": \"https://example.com/peptplus/webhooks\",\n  \"description\": \"Pharmacy system, production\",\n  \"events\": [\n    \"order.created\",\n    \"order.status_changed\",\n    \"shipment.created\"\n  ],\n  \"active\": true,\n  \"disabled_reason\": null,\n  \"secret_hint\": \"9c4e\",\n  \"stats\": {\n    \"delivered\": 128,\n    \"failed\": 2,\n    \"consecutive_failures\": 0,\n    \"last_delivered_at\": \"2026-10-29T14:31:02.000Z\"\n  },\n  \"created_at\": \"2026-10-29T10:00:00.000Z\",\n  \"updated_at\": \"2026-10-29T14:31:02.000Z\",\n  \"recent_deliveries\": [\n    {\n      \"id\": \"whd_0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d\",\n      \"object\": \"webhook_delivery\",\n      \"endpoint\": \"whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8\",\n      \"event\": \"evt_2a2f3b4c-5d6e-4f70-8a9b-0c1d2e3f4a5b\",\n      \"type\": \"order.created\",\n      \"status\": \"delivered\",\n      \"attempt_count\": 1,\n      \"next_attempt_at\": null,\n      \"last_attempt_at\": \"2026-10-29T14:31:02.000Z\",\n      \"last_status_code\": 200,\n      \"last_error\": null,\n      \"delivered_at\": \"2026-10-29T14:31:02.000Z\",\n      \"replay_of\": null,\n      \"created_at\": \"2026-10-29T14:30:10.000Z\"\n    }\n  ]\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One endpoint with its 20 most recent deliveries. Poll this after POST /webhooks/{id}/test to see the ping result. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One endpoint with its 20 most recent deliveries. Poll this after POST /webhooks/{id}/test to see the ping result. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One endpoint with its 20 most recent deliveries. Poll this after POST /webhooks/{id}/test to see the ping result. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "GET",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "One endpoint with its 20 most recent deliveries. Poll this after POST /webhooks/{id}/test to see the ping result. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Delete a webhook endpoint",
          "request": {
            "method": "DELETE",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              },
              {
                "key": "Idempotency-Key",
                "value": "{{$guid}}",
                "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/webhooks/:id",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "webhooks",
                ":id"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "Remove the endpoint. Pending deliveries are dropped; the delivery log is kept. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
          },
          "response": [
            {
              "name": "200 Confirmation",
              "originalRequest": {
                "method": "DELETE",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Remove the endpoint. Pending deliveries are dropped; the delivery log is kept. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "Confirmation",
              "code": 200,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8\",\n  \"object\": \"webhook_endpoint\",\n  \"deleted\": true\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "DELETE",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Remove the endpoint. Pending deliveries are dropped; the delivery log is kept. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "DELETE",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Remove the endpoint. Pending deliveries are dropped; the delivery log is kept. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "DELETE",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Remove the endpoint. Pending deliveries are dropped; the delivery log is kept. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "DELETE",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  },
                  {
                    "key": "Idempotency-Key",
                    "value": "{{$guid}}",
                    "description": "Optional, 1 to 255 characters. The first request runs and its status and body are stored for 24 hours, scoped to the key. The same key with the same method, path and body replays the stored response; a different body returns 422 idempotency_error. Responses of 500 and above are not stored.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Remove the endpoint. Pending deliveries are dropped; the delivery log is kept. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab. Honors `Idempotency-Key` (replays return the stored response with `Idempotent-Replayed: true`; a reused key with a different body returns 422 idempotency_error)."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        },
        {
          "name": "Send a test event",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "X-Request-Id",
                "value": "{{$guid}}",
                "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                "disabled": true
              }
            ],
            "url": {
              "raw": "{{base_url}}/webhooks/:id/test",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "webhooks",
                ":id",
                "test"
              ],
              "variable": [
                {
                  "key": "id",
                  "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                  "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                }
              ]
            },
            "description": "Queue a `ping` event for the endpoint. The dispatcher runs every 15 minutes, so the delivery is pending until its next run. Idempotency-Key is not honored on this route. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
          },
          "response": [
            {
              "name": "202 The queued delivery",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id/test",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id",
                    "test"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Queue a `ping` event for the endpoint. The dispatcher runs every 15 minutes, so the delivery is pending until its next run. Idempotency-Key is not honored on this route. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "The queued delivery",
              "code": 202,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"id\": \"whd_0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d\",\n  \"object\": \"webhook_delivery\",\n  \"endpoint\": \"whe_4e5f6a7b-8c9d-4e0f-a1b2-c3d4e5f6a7b8\",\n  \"event\": \"evt_2a2f3b4c-5d6e-4f70-8a9b-0c1d2e3f4a5b\",\n  \"type\": \"ping\",\n  \"status\": \"pending\",\n  \"attempt_count\": 0,\n  \"next_attempt_at\": \"2026-10-29T14:45:00.000Z\",\n  \"last_attempt_at\": null,\n  \"last_status_code\": null,\n  \"last_error\": null,\n  \"delivered_at\": null,\n  \"replay_of\": null,\n  \"created_at\": \"2026-10-29T14:30:10.000Z\"\n}"
            },
            {
              "name": "401 Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id/test",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id",
                    "test"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Queue a `ping` event for the endpoint. The dispatcher runs every 15 minutes, so the delivery is pending until its next run. Idempotency-Key is not honored on this route. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "Missing, malformed, unknown, revoked or environment-mismatched key, a key whose org type cannot use the API, or an organization that is not active (pending or suspended)",
              "code": 401,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"authentication_error\",\n    \"message\": \"Unknown or revoked API key.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "404 No such object visible to this organization, or no such API route",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id/test",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id",
                    "test"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Queue a `ping` event for the endpoint. The dispatcher runs every 15 minutes, so the delivery is pending until its next run. Idempotency-Key is not honored on this route. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "No such object visible to this organization, or no such API route",
              "code": 404,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"not_found\",\n    \"message\": \"Order not found.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            },
            {
              "name": "429 The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id/test",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id",
                    "test"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Queue a `ping` event for the endpoint. The dispatcher runs every 15 minutes, so the delivery is pending until its next run. Idempotency-Key is not honored on this route. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "The key exceeded its per-minute limit (default 600), or an IP made more than 60 failed authentications in a minute",
              "code": 429,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"rate_limit_error\",\n    \"message\": \"Too many requests. Slow down and retry after the window resets.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\",\n    \"retry_after\": 17\n  }\n}"
            },
            {
              "name": "500 Unexpected failure",
              "originalRequest": {
                "method": "POST",
                "header": [
                  {
                    "key": "Accept",
                    "value": "application/json"
                  },
                  {
                    "key": "X-Request-Id",
                    "value": "{{$guid}}",
                    "description": "Optional correlation id (1 to 128 characters from A-Z a-z 0-9 . _ : -). Echoed in the response header and the error envelope.",
                    "disabled": true
                  }
                ],
                "url": {
                  "raw": "{{base_url}}/webhooks/:id/test",
                  "host": [
                    "{{base_url}}"
                  ],
                  "path": [
                    "webhooks",
                    ":id",
                    "test"
                  ],
                  "variable": [
                    {
                      "key": "id",
                      "value": "ord_6c20a1f0-9b2e-4c1a-8e7d-3f5a2b1c0d9e",
                      "description": "Object id, prefixed (for example ord_...) or the bare UUID."
                    }
                  ]
                },
                "description": "Queue a `ping` event for the endpoint. The dispatcher runs every 15 minutes, so the delivery is pending until its next run. Idempotency-Key is not honored on this route. Requires scope `webhooks:manage`. Allowed org types: provider_practice, pharmacy, lab."
              },
              "status": "Unexpected failure",
              "code": 500,
              "_postman_previewlanguage": "json",
              "header": [
                {
                  "key": "Content-Type",
                  "value": "application/json"
                },
                {
                  "key": "X-API-Version",
                  "value": "2026-10-29"
                }
              ],
              "body": "{\n  \"error\": {\n    \"type\": \"internal_error\",\n    \"message\": \"Internal error.\",\n    \"request_id\": \"2b1f6d0e-4a1c-4b7e-9f3a-0c8d7e6f5a4b\"\n  }\n}"
            }
          ]
        }
      ]
    }
  ]
}