Compounding pharmacy ordering REST API

Overview

• A JSON REST API over HTTPS at https://www.compoundingfinder.com/api/v1.
• Server to server only. Your keys and webhook secrets must stay on your servers, never in a browser or a mobile app.
• Money is in integer cents (USD): 3900 is $39.00. Times are ISO 8601 in UTC.
• IDs carry a prefix: co_ orders, lst_ listings, whe_ webhook endpoints, evt_ events. Order numbers such as CO-7K3M-Q9T2 are for people.
• Every order is a 503A prescription for one named patient. Controlled substances are refused, and GLP-1 orders need a documented medical necessity reason and our review.

Quick start

1. Sign in to your clinic dashboard and add your practice details (API orders print your practice name, phone and address on the prescription). Then open Developers, accept the API terms and create a test key.
2. Check the key, search, place a test order and move it along:

# A test key from your clinic dashboard (Developers)
export CF_API_KEY="cfk_test_..."

# 1. Check the key
curl https://www.compoundingfinder.com/api/v1/account \
  -H "Authorization: Bearer $CF_API_KEY"

# 2. Find a listing that ships to your patient's state
curl "https://www.compoundingfinder.com/api/v1/medications?query=naltrexone%204.5&state=TX" \
  -H "Authorization: Bearer $CF_API_KEY"

# 3. Place a test order (order.json holds the body under "Create an order")
curl https://www.compoundingfinder.com/api/v1/orders \
  -H "Authorization: Bearer $CF_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 9f1c2e8a-4b7d-4e8a-9c5f-1d2e3f4a5b6c" \
  --data @order.json

# 4. Move it along as the pharmacy would (test keys only)
curl https://www.compoundingfinder.com/api/v1/test/orders/co_4n7cq2m8w1ht6r9x3kd5/advance \
  -H "Authorization: Bearer $CF_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{}'

Then add a webhook endpoint and watch the events arrive as you advance the order. When you are ready for real orders, ask for live access from your dashboard and create a live key.

Authentication

Send your key as a bearer token on every request:

Authorization: Bearer cfk_test_...

• Test keys start cfk_test_ and live keys cfk_live_, followed by 43 characters. The key decides the mode of every request made with it.
• Create and revoke keys on the Developers page of your clinic dashboard, after accepting the API terms. A key is shown once, when you create it. An account can have 10 active keys.
• Live keys can be created once live ordering is turned on for your account.
• A missing, malformed, unknown or revoked key gets 401 unauthorized. If a key leaks, revoke it and create a new one.

Test and live mode

Live orders need all of these. Until then, live requests get the matching error:

• An approved prescriber profile (prescriber_not_verified).
• Your practice's signed Business Associate Agreement, at the current version (baa_required).
• Live access, which you ask for from your dashboard and we turn on (live_not_enabled).
• Live ordering not paused across Compounding Finder (live_paused).

While any of these is missing, a live key can still read your account, list and read orders, cancel an order and list or delete webhook endpoints, so you can always see and stop what you have. Retrying an order you already placed, with the same Idempotency-Key and body within 24 hours, still returns that order. Everything else, a new live order included, answers 403 with the first missing step as the code and all of them in error.data.blockers. A key only ever sees its own mode: a test key gets 404 not_found for a live order or listing, and the other way round.

Requests and responses

• Send request bodies as a JSON object with Content-Type: application/json, up to 1 MB. Fields we do not use are ignored.
• Every response is JSON and carries Cache-Control: no-store and an X-Request-Id header. Include the request id when you contact us about a request.
• Lists come in one envelope, paged by cursor (see Pagination):

{
  "object": "list",
  "url": "/api/v1/orders",
  "data": [],
  "hasMore": false,
  "nextCursor": null
}

Errors

Errors share one shape. Match on code: message is written for people and may change. issues lists each problem field, and type links here: https://www.compoundingfinder.com/for-clinics/api#errors.

{
  "error": {
    "type": "https://www.compoundingfinder.com/for-clinics/api#errors",
    "code": "invalid_order",
    "message": "Check the order details.",
    "issues": [
      {
        "field": "patient.dob",
        "code": "invalid",
        "message": "Enter the date of birth as YYYY-MM-DD."
      },
      {
        "field": "items[0].sig",
        "code": "required",
        "message": "Enter the directions for use (sig)."
      }
    ],
    "data": {}
  }
}

data is empty unless the code carries detail: orderId for order_already_exists; itemsCents, shippingCents, totalCents, expectedTotalCents and lines (each item's listingId, unitPriceCents, priceCents and shippingCents, priced now) for price_changed; reason, listingId and state for pharmacy_cannot_fill; reasons for necessity_reason_rejected; listingId for listing_unavailable; blockers for the live-mode codes.

Rate limits

• 300 requests a minute for each key.
• 30 requests a minute from one IP address with a missing or invalid key.
• Adding webhook endpoints: 20 an hour for each account, counted together with the Developers page. Refused attempts count.
• Order requests for each account: 500 a day in live mode and 200 a day in test mode. Each day starts at midnight UTC. The limit counts requests to place an order, not orders placed: a request refused for a problem with the order, such as invalid_order or price_changed, still counts. A replay (the same Idempotency-Key and body) does not.

Past a limit you get 429 rate_limited, with a Retry-After header giving the seconds to wait before trying again.

Pagination

List endpoints take limit (1 to 100, default 25) and startingAfter. When hasMore is true, pass the response's nextCursor as startingAfter to get the next page. Cursors are opaque: do not build or change them.

curl "https://www.compoundingfinder.com/api/v1/medications?limit=2&startingAfter=eyJvIjoyfQ" \
  -H "Authorization: Bearer $CF_API_KEY"

Idempotency and duplicate orders

Networks fail, and a retried order must never become two prescriptions. Two things protect you, and you can use both:

• Idempotency-Key header on POST /api/v1/orders: 1 to 255 visible ASCII characters, unique to the order, such as a UUID. For 24 hours, the same key with the same body returns the original order (200 OK, Idempotent-Replayed: true) instead of placing a new one. The same key with a different body gets 409 idempotency_key_reused. Keys are kept per account and mode.
• externalOrderId in the body: your own ID, at most one order per ID in each mode, with no time limit. A second order with it gets 409 order_already_exists, and error.data.orderId is the order you already placed. While the first request with that ID is still being placed, a second one gets 409 order_in_progress instead. It names no order, because the first request may still fail: try again in a few seconds. A request that was cut off before it finished holds its ID for up to 2 minutes.

To guard against a price change between showing a total and placing the order, send expectedTotalCents. If the total has moved, nothing is placed and you get 409 price_changed with the current totals in error.data, and each item's current prices in error.data.lines:

{
  "error": {
    "type": "https://www.compoundingfinder.com/for-clinics/api#errors",
    "code": "price_changed",
    "message": "The total for this order is now $129.00. Review it and place the order again.",
    "issues": [],
    "data": {
      "itemsCents": 11700,
      "shippingCents": 1200,
      "totalCents": 12900,
      "expectedTotalCents": 12000,
      "lines": [
        {
          "listingId": "lst_sbx_ldn45",
          "unitPriceCents": 3900,
          "priceCents": 11700,
          "shippingCents": 1200
        }
      ]
    }
  }
}

Endpoints

• GET/api/v1/account
• GET/api/v1/medications
• GET/api/v1/medications/{id}
• POST/api/v1/orders
• GET/api/v1/orders
• GET/api/v1/orders/{id}
• POST/api/v1/orders/{id}/cancel
• GET/api/v1/webhook-endpoints
• POST/api/v1/webhook-endpoints
• DELETE/api/v1/webhook-endpoints/{id}
• POST/api/v1/test/orders/{id}/advance

curl https://www.compoundingfinder.com/api/v1/account \
  -H "Authorization: Bearer $CF_API_KEY"

{
  "object": "account",
  "id": "example-clinic",
  "practiceName": "Example Telehealth Clinic",
  "mode": "test",
  "liveEnabled": false,
  "verificationStatus": "approved"
}

curl "https://www.compoundingfinder.com/api/v1/medications?query=naltrexone%204.5&state=TX" \
  -H "Authorization: Bearer $CF_API_KEY"

{
  "object": "list",
  "url": "/api/v1/medications",
  "data": [
    {
      "object": "medication",
      "id": "lst_sbx_ldn45",
      "name": "Low Dose Naltrexone (LDN)",
      "strength": "4.5 mg",
      "form": "Capsule",
      "formOption": "Capsule",
      "quantity": {
        "amount": 30,
        "unit": "capsules",
        "label": "30 capsules"
      },
      "price": 3900,
      "listPrice": 3900,
      "currency": "usd",
      "shipping": 1200,
      "leadTimeDays": 3,
      "requiresMedicalNecessityReason": false,
      "sterile": false,
      "pharmacy": {
        "id": "ph_cf_sandbox",
        "name": "Compounding Finder Test Pharmacy",
        "city": "Austin",
        "state": "TX",
        "credentials": {
          "pcab": false,
          "legitScript": false,
          "licenseVerified": false
        }
      },
      "updatedAt": "2026-10-26T12:00:00.000Z"
    }
  ],
  "hasMore": false,
  "nextCursor": null
}

curl https://www.compoundingfinder.com/api/v1/medications/lst_sbx_ldn45 \
  -H "Authorization: Bearer $CF_API_KEY"

{
  "object": "medication",
  "id": "lst_sbx_ldn45",
  "name": "Low Dose Naltrexone (LDN)",
  "strength": "4.5 mg",
  "form": "Capsule",
  "formOption": "Capsule",
  "quantity": {
    "amount": 30,
    "unit": "capsules",
    "label": "30 capsules"
  },
  "price": 3900,
  "listPrice": 3900,
  "currency": "usd",
  "shipping": 1200,
  "leadTimeDays": 3,
  "requiresMedicalNecessityReason": false,
  "sterile": false,
  "pharmacy": {
    "id": "ph_cf_sandbox",
    "name": "Compounding Finder Test Pharmacy",
    "city": "Austin",
    "state": "TX",
    "credentials": {
      "pcab": false,
      "legitScript": false,
      "licenseVerified": false
    }
  },
  "updatedAt": "2026-10-26T12:00:00.000Z"
}

{
  "externalOrderId": "EHR-100045",
  "patient": {
    "firstName": "Test",
    "lastName": "Patient",
    "dob": "1980-01-01",
    "sex": "female",
    "email": "test.patient@example.com",
    "phone": "5125550199",
    "address1": "200 Sample Road",
    "city": "Austin",
    "state": "TX",
    "zip": "78701",
    "allergies": "NKDA"
  },
  "items": [
    {
      "listingId": "lst_sbx_ldn45",
      "count": 3,
      "sig": "Take 1 capsule by mouth at bedtime.",
      "refills": 2,
      "daysSupply": 90
    }
  ],
  "shipTo": "patient",
  "billTo": "clinic",
  "billingEmail": "billing@clinic.example",
  "expectedTotalCents": 12900,
  "prescriber": {
    "npi": "1234567893",
    "firstName": "Test",
    "lastName": "Prescriber",
    "credentials": "MD",
    "licenseState": "TX",
    "licenseNumber": "MD-12345",
    "phone": "5125550100"
  },
  "signatureAttestation": true
}

curl https://www.compoundingfinder.com/api/v1/orders \
  -H "Authorization: Bearer $CF_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 9f1c2e8a-4b7d-4e8a-9c5f-1d2e3f4a5b6c" \
  --data @order.json

{
  "object": "order",
  "id": "co_4n7cq2m8w1ht6r9x3kd5",
  "orderNumber": "CO-7K3M-Q9T2",
  "externalOrderId": "EHR-100045",
  "mode": "test",
  "status": "submitted",
  "statusLabel": "Sent to pharmacy",
  "totals": {
    "itemsCents": 11700,
    "shippingCents": 1200,
    "totalCents": 12900
  },
  "createdAt": "2026-10-26T15:04:05.000Z"
}

curl "https://www.compoundingfinder.com/api/v1/orders?status=submitted&limit=25" \
  -H "Authorization: Bearer $CF_API_KEY"

{
  "object": "list",
  "url": "/api/v1/orders",
  "data": [
    {
      "object": "order",
      "id": "co_4n7cq2m8w1ht6r9x3kd5",
      "orderNumber": "CO-7K3M-Q9T2",
      "externalOrderId": "EHR-100045",
      "status": "submitted",
      "statusLabel": "Sent to pharmacy",
      "updatedAt": "2026-10-26T15:04:05.000Z"
    }
  ],
  "hasMore": false,
  "nextCursor": null
}

curl https://www.compoundingfinder.com/api/v1/orders/co_4n7cq2m8w1ht6r9x3kd5 \
  -H "Authorization: Bearer $CF_API_KEY"

{
  "object": "order",
  "id": "co_4n7cq2m8w1ht6r9x3kd5",
  "orderNumber": "CO-7K3M-Q9T2",
  "externalOrderId": "EHR-100045",
  "status": "submitted",
  "statusLabel": "Sent to pharmacy",
  "shipments": [],
  "updatedAt": "2026-10-26T15:04:05.000Z"
}

curl https://www.compoundingfinder.com/api/v1/orders/co_4n7cq2m8w1ht6r9x3kd5/cancel \
  -H "Authorization: Bearer $CF_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{"note": "Patient changed their mind"}'

{
  "object": "order",
  "id": "co_4n7cq2m8w1ht6r9x3kd5",
  "orderNumber": "CO-7K3M-Q9T2",
  "externalOrderId": "EHR-100045",
  "status": "processing",
  "statusLabel": "Accepted by pharmacy",
  "cancelRequestedAt": "2026-10-27T09:12:00.000Z",
  "updatedAt": "2026-10-27T09:12:00.000Z"
}

curl https://www.compoundingfinder.com/api/v1/webhook-endpoints \
  -H "Authorization: Bearer $CF_API_KEY"

{
  "object": "list",
  "url": "/api/v1/webhook-endpoints",
  "data": [
    {
      "id": "whe_6t3n8q1m4k7c2x9w5r0h",
      "url": "https://hooks.clinic.example/compounding-finder",
      "mode": "test",
      "createdAt": "2026-10-26T14:30:00.000Z"
    }
  ],
  "hasMore": false,
  "nextCursor": null
}

curl https://www.compoundingfinder.com/api/v1/webhook-endpoints \
  -H "Authorization: Bearer $CF_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{"url": "https://hooks.clinic.example/compounding-finder"}'

{
  "endpoint": {
    "id": "whe_6t3n8q1m4k7c2x9w5r0h",
    "url": "https://hooks.clinic.example/compounding-finder",
    "mode": "test",
    "createdAt": "2026-10-26T14:30:00.000Z"
  },
  "secret": "whsec_ExampleSecretDoNotUse0000000000000000000000"
}

curl -X DELETE https://www.compoundingfinder.com/api/v1/webhook-endpoints/whe_6t3n8q1m4k7c2x9w5r0h \
  -H "Authorization: Bearer $CF_API_KEY"

{
  "id": "whe_6t3n8q1m4k7c2x9w5r0h",
  "deleted": true
}

curl https://www.compoundingfinder.com/api/v1/test/orders/co_4n7cq2m8w1ht6r9x3kd5/advance \
  -H "Authorization: Bearer $CF_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{}'

{
  "object": "order",
  "id": "co_4n7cq2m8w1ht6r9x3kd5",
  "orderNumber": "CO-7K3M-Q9T2",
  "externalOrderId": "EHR-100045",
  "status": "processing",
  "statusLabel": "Accepted by pharmacy",
  "acceptedAt": "2026-10-26T15:10:00.000Z",
  "updatedAt": "2026-10-26T15:10:00.000Z"
}

The order object

What every order endpoint returns. It holds the patient's details, so treat API responses as protected health information. Webhooks never carry them.

{
  "object": "order",
  "id": "co_4n7cq2m8w1ht6r9x3kd5",
  "orderId": "co_4n7cq2m8w1ht6r9x3kd5",
  "orderNumber": "CO-7K3M-Q9T2",
  "version": 1,
  "mode": "test",
  "source": "api",
  "externalOrderId": "EHR-100045",
  "slug": "example-clinic",
  "practice": {
    "name": "Example Telehealth Clinic",
    "phone": "(512) 555-0100",
    "email": "orders@clinic.example",
    "address1": "100 Example Street",
    "address2": "Suite 200",
    "city": "Austin",
    "state": "TX",
    "zip": "78701"
  },
  "prescriber": {
    "name": "Test Prescriber",
    "firstName": "Test",
    "lastName": "Prescriber",
    "credentials": "MD",
    "npi": "1234567893",
    "licenseState": "TX",
    "licenseNumber": "MD-12345",
    "phone": "5125550100",
    "email": "orders@clinic.example",
    "npiCheck": {
      "status": "skipped"
    }
  },
  "patient": {
    "firstName": "Test",
    "lastName": "Patient",
    "dob": "1980-01-01",
    "sex": "female",
    "email": "test.patient@example.com",
    "phone": "5125550199",
    "address1": "200 Sample Road",
    "address2": "",
    "city": "Austin",
    "state": "TX",
    "zip": "78701",
    "allergies": "NKDA",
    "weight": ""
  },
  "pharmacy": {
    "id": "ph_cf_sandbox",
    "name": "Compounding Finder Test Pharmacy",
    "phone": "(512) 555-0123",
    "city": "Austin",
    "state": "TX"
  },
  "items": [
    {
      "lineId": "l1",
      "listingId": "lst_sbx_ldn45",
      "priceRowId": "sbx_ldn45",
      "medication": {
        "name": "Low Dose Naltrexone (LDN)",
        "strength": "4.5 mg",
        "form": "Capsule",
        "formOption": "Capsule"
      },
      "packageQuantity": {
        "amount": 30,
        "unit": "capsules",
        "label": "30 capsules"
      },
      "count": 3,
      "rxQuantity": "90 capsules",
      "sig": "Take 1 capsule by mouth at bedtime.",
      "refills": 2,
      "daysSupply": 90,
      "notes": "",
      "substitutionAllowed": false,
      "restricted": false,
      "unitPriceCents": 3900,
      "priceCents": 11700,
      "shippingCents": 1200
    }
  ],
  "medicalNecessityReason": "",
  "shipTo": "patient",
  "shipToAddress": {
    "name": "Test Patient",
    "address1": "200 Sample Road",
    "address2": "",
    "city": "Austin",
    "state": "TX",
    "zip": "78701"
  },
  "billTo": "clinic",
  "billingEmail": "billing@clinic.example",
  "notesToPharmacy": "",
  "totals": {
    "itemsCents": 11700,
    "shippingCents": 1200,
    "totalCents": 12900
  },
  "feeCents": 0,
  "feeSchedule": "launch-free-2026-10",
  "status": "submitted",
  "statusHistory": [
    {
      "status": "submitted",
      "at": "2026-10-26T15:04:05.000Z",
      "actor": "system",
      "note": ""
    }
  ],
  "failureReason": null,
  "declineReason": null,
  "declineNote": "",
  "cancelRequestedAt": null,
  "cancelNote": "",
  "review": {
    "required": false,
    "reasons": [],
    "decidedAt": null,
    "note": ""
  },
  "shipments": [],
  "acceptedAt": null,
  "shippedAt": null,
  "deliveredAt": null,
  "cancelledAt": null,
  "failedAt": null,
  "pharmacyNotifiedAt": null,
  "reminderSentAt": null,
  "rx": {
    "fileName": "clinic-order-CO-7K3M-Q9T2.pdf",
    "renderedAt": "2026-10-26T15:04:05.000Z",
    "stateNotice": null,
    "signature": {
      "signedName": "Test Prescriber",
      "attested": true,
      "signedAt": "2026-10-26T15:04:05.000Z",
      "via": "api"
    }
  },
  "createdAt": "2026-10-26T15:04:05.000Z",
  "updatedAt": "2026-10-26T15:04:05.000Z",
  "statusLabel": "Sent to pharmacy",
  "pdfUrl": null
}

Statuses

How an order moves

delivered, cancelled and failed are final. Compounding Finder can also correct an order's status, always with a note; you get the event for the new status.

Failure and decline reasons

Webhooks

We POST an event to each of your endpoints in the order's mode whenever an order changes. Add endpoints on the Developers page or with the API. Events carry no patient details: fetch the order with your key when you need them.

Endpoint rules

• An https:// URL on the standard port (443), up to 2,048 characters.
• A public hostname. Addresses on private, loopback, link-local or reserved networks are refused, when you add the endpoint and again on every delivery.
• No username, password or # part in the URL. Redirects are not followed.
• Up to 5 endpoints in each mode, each URL once.

Events

Payload

{
  "id": "evt_2w9m4q7k1c8x3t6n5r0d",
  "object": "event",
  "type": "order.shipped",
  "createdAt": "2026-10-28T16:20:00.000Z",
  "mode": "test",
  "data": {
    "order": {
      "id": "co_4n7cq2m8w1ht6r9x3kd5",
      "orderNumber": "CO-7K3M-Q9T2",
      "externalOrderId": "EHR-100045",
      "status": "shipped",
      "failureReason": null,
      "declineReason": null,
      "cancelRequestedAt": null,
      "shipments": [
        {
          "carrier": "TEST",
          "trackingNumber": "TEST-7K3MQ9T2",
          "trackingUrl": "",
          "shippedAt": "2026-10-28T16:20:00.000Z"
        }
      ],
      "updatedAt": "2026-10-28T16:20:00.000Z"
    }
  }
}

Headers

POST /compounding-finder HTTP/1.1
Host: hooks.clinic.example
Content-Type: application/json
User-Agent: CompoundingFinder-Webhooks/1.0
CF-Event-Id: evt_2w9m4q7k1c8x3t6n5r0d
CF-Event-Type: order.shipped
CF-Signature: t=1793204400,v1=adf1340dcb3be762b94f2934047efb55f6fd79cccd57b497d4408f875119bec0

CF-Signature is t= the Unix time in seconds, then v1= the hex HMAC-SHA256 of the string t + "." + raw body, keyed with your endpoint's whole secret (whsec_ included). There may be more than one v1 value; accept the event when any of them matches.

Verifying a signature (Node.js)

import crypto from 'node:crypto';
import express from 'express';

const app = express();

// Keep the raw body: the signature covers the exact bytes we sent.
app.post('/compounding-finder', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('CF-Signature') || '';
  if (!verifySignature(process.env.CF_WEBHOOK_SECRET, req.body, header)) {
    return res.status(400).send('Bad signature');
  }
  const event = JSON.parse(req.body.toString('utf8'));
  res.sendStatus(200); // answer within 10 seconds, then do the work
  handleEvent(event); // skip event.id values you have already handled
});

function verifySignature(secret, rawBody, header, toleranceSeconds = 300) {
  let timestamp = '';
  const signatures = [];
  for (const part of header.split(',')) {
    const at = part.indexOf('=');
    if (at === -1) continue;
    const name = part.slice(0, at).trim();
    const value = part.slice(at + 1).trim();
    if (name === 't') timestamp = value;
    if (name === 'v1') signatures.push(value);
  }
  if (!/^\d+$/.test(timestamp) || signatures.length === 0) return false;
  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
  if (age > toleranceSeconds) return false;
  const expected = crypto.createHmac('sha256', secret)
    .update(timestamp + '.')
    .update(rawBody)
    .digest();
  return signatures.some((signature) => {
    const given = Buffer.from(signature, 'hex');
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

• Use the raw body exactly as received. Parsing and re-serialising the JSON changes the bytes and the signature will not match.
• Reject a t more than 300 seconds from your clock, so an old event cannot be replayed.
• Deduplicate on CF-Event-Id (the event's id): a delivery can arrive more than once.
• Events can arrive out of order. Compare data.order.updatedAt, or fetch the order for its latest state.

Delivery and retries

A delivery succeeds when your endpoint answers with a 2xx status within 10 seconds (3 seconds for the first attempt, made the moment the order changes). Anything else is retried about 1, 5 and 15 minutes, then 1, 3, 6, 12 and 24 hours after each failed attempt (retries go out from a scheduled job, so a retry can come several minutes later): nine attempts over about two days. After that the delivery is marked failed. The Developers page shows recent deliveries and sends test events (webhook_endpoint.test), which are not retried.

Testing

Test keys order from the Compounding Finder Test Pharmacy (pharmacy id ph_cf_sandbox, Austin, TX), which ships to every state. Its listings have ids starting lst_sbx_. Test orders go through the same checks, statuses and webhooks as live ones, but never reach a pharmacy and send no emails. Their prescription PDF is watermarked as a test order, not a valid prescription. Use made-up patient details only.

Move a test order with POST /api/v1/test/orders/{id}/advance or the buttons on its page in your dashboard:

• No to: the next step on the usual path. A test order that needs review is approved first.
• processing, shipped, delivered: as the pharmacy accepting it, shipping it (carrier TEST, a tracking number that starts TEST-) and marking it delivered. A later target walks through every step on the way, each with its own webhook.
• failed: as if we rejected it in review, the pharmacy declined it or, once accepted, the pharmacy could not fill it.
• cancelled: cancels it. Once the order is accepted, this stands for the pharmacy confirming your cancel request.

A move the order cannot make from where it is, such as advancing a delivered order, gets 409 invalid_transition.

To try a cancel request, advance an order to processing, cancel it (202 Accepted), then advance it to cancelled.