orders family
List the buyer's own orders at one shop — identity comes from a signed, short-lived link token, never from the body
One click hands your coding agent a prompt that registers the substrate, reads this contract, and makes the call. Launch opens the app; the others copy the prompt.
curl -X POST https://one.ie/api/ask/orders:mine \
-H "Authorization: Bearer $ONE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"data": { "workspace": "acme", "token": "<uid>.<exp>.<sig>" }}'The key is never in a link. npx -y @oneie/cli login writes it to ~/.config/oneie/key on your machine.
Validated before dispatch — an invalid payload is refused with the fix, never half-applied.
workspace string required The SELLER's slug — whose shop these orders were placed at. Bound into the token's MAC, so it narrows the read and cannot widen it. token string required The signed order-history link token (`<uid>.<exp>.<sig>`), minted server-side and emailed to the address that placed the orders. The ONLY source of buyer identity; forged, tampered or cross-shop tokens are refused before D1 is touched. oid string optional Read ONE order instead of the list. An oid belonging to another buyer answers `not_found` — never `forbidden`, which would confirm the row exists. cursor string optional Keyset cursor `<created_at>:<oid>` from a previous page's `nextCursor`. Absent starts at the newest order. limit number optional Page size, default 20, clamped to 50. What comes back from the call.
orders object[] Newest first. Each row: oid, status, amountTotal (cents), currency, createdAt, items[{label, quantity, unitAmount}]. No PII and no payment plumbing — pii_ref, payment_intent, stripe_account and session_id are never selected. order object Present instead of `orders` when `oid` was supplied. total number EXACT count of this buyer's orders at this shop, over all pages — a COUNT(*), not a floor. nextCursor string Present if and only if more rows match. Absent means you have them all; absent is not `false`. error string `forbidden` (no/forged/cross-shop token), `link_expired` (a real token past its 30-minute life), `not_found` (an oid that is not this buyer's), `link_not_configured` (the signing secret is unset — fails closed), `workspace_required`, `no_db`. Every call to orders:mine, counted where it is dispatched — over HTTP or in-process alike. Aggregate only — no actor, no payload, no workspace.
Counting…
Every place in the open source that names orders:mine, and the file that
answers it. Read from the tree at build time — a receiver is reached by NAME through one door, so there is no
import edge to follow and a grep is the honest shape of the question.
Structure, not volume — the count is in Traffic above.
Called from
Answered by
POST /api/ask/orders:mine, after the envelope
validates the payload.
orders family · 2 more
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"properties": {
"workspace": {
"type": "string",
"description": "The SELLER's slug — whose shop these orders were placed at. Bound into the token's MAC, so it narrows the read and cannot widen it."
},
"token": {
"type": "string",
"description": "The signed order-history link token (`<uid>.<exp>.<sig>`), minted server-side and emailed to the address that placed the orders. The ONLY source of buyer identity; forged, tampered or cross-shop tokens are refused before D1 is touched."
},
"oid": {
"description": "Read ONE order instead of the list. An oid belonging to another buyer answers `not_found` — never `forbidden`, which would confirm the row exists.",
"type": "string"
},
"cursor": {
"description": "Keyset cursor `<created_at>:<oid>` from a previous page's `nextCursor`. Absent starts at the newest order.",
"type": "string"
},
"limit": {
"description": "Page size, default 20, clamped to 50.",
"type": "integer",
"exclusiveMinimum": 0,
"maximum": 9007199254740991
}
},
"required": [
"workspace",
"token"
]
} {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"properties": {
"orders": {
"description": "Newest first. Each row: oid, status, amountTotal (cents), currency, createdAt, items[{label, quantity, unitAmount}]. No PII and no payment plumbing — pii_ref, payment_intent, stripe_account and session_id are never selected.",
"type": "array",
"items": {
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
}
},
"order": {
"description": "Present instead of `orders` when `oid` was supplied.",
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
},
"total": {
"description": "EXACT count of this buyer's orders at this shop, over all pages — a COUNT(*), not a floor.",
"type": "number"
},
"nextCursor": {
"description": "Present if and only if more rows match. Absent means you have them all; absent is not `false`.",
"type": "string"
},
"error": {
"description": "`forbidden` (no/forged/cross-shop token), `link_expired` (a real token past its 30-minute life), `not_found` (an oid that is not this buyer's), `link_not_configured` (the signing secret is unset — fails closed), `workspace_required`, `no_db`.",
"type": "string"
}
}
}