PUT
Replace an order's shipping address

Authorizations

Authorization
string
header
required

A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.

Headers

Idempotency-Key
string
required

A unique key per logical write. Replaying a request with the same key returns the first response byte for byte instead of applying the write twice.

Path Parameters

orderId
string
required

Body

application/json

The body IS the address document; there is no shipping_address wrapper. It REPLACES the stored address wholesale, so an omitted optional field is stored as empty: correcting a postal code without resending phone erases the phone number the carrier needs. Refused with 409 once the order carries a shipment or has moved past paid, because after that the parcel has gone and a rewrite would make the record lie about where it went. Money is snapshotted at placement, so this does NOT recompute tax for the new destination.

first_name
string
required

Required.

Maximum string length: 255
last_name
string
required

Required.

Maximum string length: 255
address_1
string
required

Required.

Maximum string length: 255
city
string
required

Required.

Maximum string length: 128
postal_code
string
required

Required.

Maximum string length: 32
country_code
string
required

Required, exactly two letters. Stored LOWERCASED, so a client that sends "US" reads "us" back from the next GET and must not treat that as a change it did not make.

Maximum string length: 2
address_2
string
Maximum string length: 255
province
string
Maximum string length: 128
phone
string
Maximum string length: 32
company
string
Maximum string length: 255

Response

Success

data
object