Commit order

Request Parameters

🏷️ header · unmarked parameters are query params

Example Request

curl 'https://www.locally.com/headless/api/1.0/cart/commit' \
--request POST \
--header 'Locally-Api-Token: {{API_TOKEN}}' \
--header 'Locally-Pl-Jwt: {{CART_HASH_JWT}}'

const response = await fetch('https://www.locally.com/headless/api/1.0/cart/commit', {
  method: 'POST',
  headers: {
    'Locally-Api-Token': '{{API_TOKEN}}',
    'Locally-Pl-Jwt': '{{CART_HASH_JWT}}'
  }
});
const data = await response.json();

import requests

url = "https://www.locally.com/headless/api/1.0/cart/commit"

headers = {
    "Locally-Api-Token": "{{API_TOKEN}}",
    "Locally-Pl-Jwt": "{{CART_HASH_JWT}}"
}

response = requests.post(url, headers=headers)
data = response.json()

The request takes no body. The cart to commit is identified by the Locally-Pl-Jwt header — pass the cart_hash_jwt value returned by a successful /headless/api/1.0/cart/validate response.

Example Response

{
  "success": true,
  "data": {
    "message": "Your order has been placed",
    "target_uri": "/order/QE3QL6/UQP778",
    "is_test": 0,
    "status_code": 200,
    "cart_hash": "QE3QL6",
    "store_uri": "/order/QE3QL6/SKP2GH",
    "session": {
      "id": "vD2kq9mXw4bT7nR5cJ1sL8fA3gH6pZ0yE2uN4iK9"
    }
  },
  "msg": ""
}

Response Explanation

• success — Boolean outcome of the call. When false, the response also carries a top-level error_code and explanatory msg — always check success, not just the HTTP status.
• data.message — Shopper-facing order outcome (here Your order has been placed). Placing an order does not capture funds — in most cases Locally captures only after the store confirms stock.
• data.target_uri — Relative URI of the shopper's order status page on locally.com, built from the cart hash and a buyer-only secret. Send the shopper here to track the order.
• data.is_test — 0 for live carts, 1 for carts created with a test_* API key — test carts use a decoy payment provider and are invisible to retailers. See Testing Your Integration.
• data.status_code — HTTP-style result of order processing duplicated inside the payload; 200 means the order was placed. Failures surface as a non-200 HTTP response with an error envelope instead.
• data.cart_hash — Unique short identifier for the cart. Other endpoints accept it as the hash parameter, and it appears in order URIs.
• data.store_uri — Retailer-scoped order link built with the store's secret. Returned only when your API token has the Retailer Secret Link permission.
• data.session.id — Locally session ID, returned on every response. Replay it via the Locally-Api-Session-Id header to persist the shopper's session between calls; expired IDs are transparently replaced with fresh ones.
• msg — Human-readable error text; empty string on success. In production, unexpected server errors are masked as App server error with a lookup reference — see Handling Errors in Production.