Auth
Register and log in. Access tokens carry USER or ADMIN, and every protected route checks the account still exists.
What it covers
Orders
Create an order, page and filter it, then move it through CREATED, PAID, SHIPPED, DELIVERED, or CANCELLED.
Reliability
Idempotency-Key on create, optimistic locking on stock, Flyway migrations, and RFC 7807 errors.
Status workflow
CREATED
→ PAID
→ SHIPPED
→ DELIVERED
CREATED or PAID can also move to CANCELLED. Cancelling puts the stock back. Customers can pay or cancel their own orders. Shipping and delivery are ADMIN actions.
Problem types
Errors use application/problem+json. The type URI points at a row in this table.
| Code | When |
|---|---|
VALIDATION_FAILED | A field, page, or sort value is invalid. |
MALFORMED_REQUEST | The JSON body cannot be read. |
IDEMPOTENCY_KEY_REQUIRED | Order creation did not send Idempotency-Key. |
IDEMPOTENCY_KEY_INVALID | The key is not 8–128 safe characters. |
UNAUTHORIZED | Missing, expired, or wrong credentials. |
FORBIDDEN | The role cannot perform the action. |
ORDER_NOT_FOUND | No such order for this caller. |
PRODUCT_NOT_FOUND | A line references a missing product. |
EMAIL_TAKEN | Registration email is already used. |
SKU_TAKEN | Catalog SKU is already used. |
IDEMPOTENCY_CONFLICT | The key was reused with a different body. |
INVALID_TRANSITION | That status move is not in the workflow. |
INSUFFICIENT_STOCK | The catalog cannot cover the quantity. |
PRODUCT_UNAVAILABLE | The product is inactive. |
CONFLICT | A concurrent update or other constraint lost. |
INTERNAL_ERROR | Unexpected server failure. |