List Orders

GET/api/v1/users/me/orders

Lists the authenticated patient's orders. Optionally filtered by case. Cursor-paginated. Sorted by createdAt descending.

cv-api-key + Bearer accessToken

Productionhttps://api.care360-next.carevalidate.com/api/v1/users/me/orders

Staginghttps://api-staging.care360-next.carevalidate.com/api/v1/users/me/orders

Headers

Headers

cv-api-keystringrequired

Your unique API key for authentication.

Authorizationstringrequired

Bearer access token from /verify-otp.

Example: Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9...

Query Parameters

Query Parameters

caseIdstringoptional

UUID. Restrict the list to a single case owned by the patient. Verified via ensurePatientOwnsCase — if the case does not belong to the patient or to the calling org, returns 403.

Example: 550e8400-e29b-41d4-a716-446655440000

limitintegeroptional

Page size. 1–100. Defaults to 20.

Example: 20

afterstringoptional

Cursor — the last id from the previous page. The server skips this row and returns the next page.

Example: 550e8400-e29b-41d4-a716-446655440000

Behavior

1. If caseId is provided, ensurePatientOwnsCase confirms the case exists, the submitterId === userId, and the organizationId matches the calling org. Otherwise → 403 VALIDATION_ERROR "You do not have access to this case".
2. If caseId is omitted, the server resolves the patient's own case ids in this org.
3. The DB query returns Order rows scoped to those case ids and the calling organizationId, ordered by createdAt descending.
4. The server takes limit + 1 rows to detect end-of-results, drops the extra, and emits its id as nextCursor. When no more rows exist, nextCursor is null.

If the patient has no cases (or the filter matches no rows), data.orders is [] and data.nextCursor is null.

Response Shape

See Orders Overview › Order for the per-row field list. The response is:

{ "status": 200, "success": true, "data": { "orders": [ "..." ], "nextCursor": "<id> | null" } }

Example Request

cURL — all

curl -X GET '<BASE_URL>/api/v1/users/me/orders' \
-H 'cv-api-key: <redacted>' \
-H 'Authorization: Bearer <accessToken>'

cURL — paginated

curl -X GET '<BASE_URL>/api/v1/users/me/orders?caseId=<CASE_ID>&limit=20&after=<LAST_ID>' \
-H 'cv-api-key: <redacted>' \
-H 'Authorization: Bearer <accessToken>'

JavaScript

const url = new URL('<BASE_URL>/api/v1/users/me/orders');
url.searchParams.set('caseId', '<CASE_ID>');
url.searchParams.set('limit', '20');

const response = await fetch(url, {
method: 'GET',
headers: {
  'cv-api-key': '<redacted>',
  'Authorization': 'Bearer <accessToken>',
},
});
const data = await response.json();
console.log(data);

Python

import requests

response = requests.get(
  '<BASE_URL>/api/v1/users/me/orders',
  headers={
      'cv-api-key': '<redacted>',
      'Authorization': 'Bearer <accessToken>',
  },
  params={'caseId': '<CASE_ID>', 'limit': 20},
)
print(response.json())

Responses

▶200SuccessReturns the patient's orders matching the filters.

{
  "status": 200,
  "success": true,
  "data": {
    "orders": [
      {
        "id": "550e8400-e29b-41d4-a716-446655440000",
        "status": "SHIPPED",
        "trackingId": "1Z999AA10123456784",
        "externalId": "rx_01HFXYZ123",
        "caseId": "550e8400-e29b-41d4-a716-446655440111",
        "createdAt": "2026-04-15T12:34:56.000Z",
        "medications": [
          {
            "medicine": "Amoxicillin",
            "dosage": "500 mg",
            "dosingFrequency": "twice daily"
          }
        ]
      }
    ],
    "nextCursor": "550e8400-e29b-41d4-a716-446655440000"
  }
}

▶400Validation errorcv-api-key missing, caseId / after not a UUID, or limit out of range.

{
  "status": 400,
  "success": false,
  "error": "Validation failed",
  "code": "VALIDATION_ERROR"
}

▶401Authentication failureAuth-middleware rejection (any cause is collapsed into this generic response).

{
  "status": 401,
  "success": false,
  "error": "Invalid or expired token",
  "code": "VALIDATION_ERROR"
}

▶403Case not ownedcaseId does not belong to the patient or to the calling org.

{
  "status": 403,
  "success": false,
  "error": "You do not have access to this case",
  "code": "VALIDATION_ERROR"
}

Try It Out

Try itAPI Playground

▶