Reveal delivered artifacts

post

https://myapi.xegora.com/api/v1/orders/{orderId}/fulfillment

Returns the fulfilled order's artifacts (codes, PINs, activation values, claim tokens). Requires the orders.reveal scope or the orders.create scope — orders.read alone is 403 — and an Idempotency-Key header. Every reveal is counted against the order's reveal limit and audited; the response is always Cache-Control: no-store, private. Keys belong to the API key that sends them: an exact replay (same API key, same Idempotency-Key, same order) within 15 minutes returns the stored response without counting a reveal, and is audited; after 15 minutes the key answers 409 fulfillment_replay_expired; a key already bound to another reveal — another order, or another of your API keys — is 409 idempotency_conflict, the same code a reused order or withdrawal key answers with, and nothing is revealed or counted. Your own order with nothing to reveal is 409 fulfillment_unavailable, usually with its orderStatus; another workspace's order is 404. Allowed while the subscription is overdue or the entitlement has ended. Artifacts never appear in order bodies or webhooks.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

orderId

uuid

required

Headers

Idempotency-Key

string

required

length between 1 and 128

Caller-generated retry token (1–128 printable characters; surrounding spaces are trimmed). Derive it from your own operation identity and persist it. For an order, the key space is the workspace's and a spent key never expires; for a reveal, the key belongs to the API key that sends it and replays for 15 minutes. A key already bound to a different order or reveal is 409 idempotency_conflict, and nothing is done under it a second time.

X-Correlation-Id

string

length ≤ 128

^[A-Za-z0-9._:-]{1,128}$

Your own correlation id, carried through Xegora's logs and audit records and returned in correlationId. Kept when it is 1–128 characters of ASCII letters, digits, ., _, : and -; anything else is replaced by an id of Xegora's.

X-Language

string

enum

The language an error's message, title and detail are written in; without it, Accept-Language decides, then English. Successful responses are not translated.

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

200The artifacts.

400The request is malformed (code = invalid_request): a bad parameter or header, a missing or malformed Idempotency-Key, or a body member the contract does not have — named, by its path in the body, in errors. Do not retry unchanged.

401No valid API key (code = unauthorized): missing, malformed, unknown, revoked or expired, or a wrong secret. The message is worded for an API key — this surface has no session to sign in to.

404No such resource in this workspace, or no such route (code = not_found).