> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.lettbestilt.no/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.lettbestilt.no/_mcp/server.

# Track an order

GET https://www.lettbestilt.no/api/v1/orders/{token}

Returns an order by its `publicToken`: status, lines, totals, times and payment status. No API key is needed, because the token is the secret. Share it only with the customer.

If an online order is still waiting for payment, the server checks with the payment provider before it responds. Polling this endpoint after the customer returns to your `successUrl` therefore gives you a reliable payment status.

`order.status` follows this path:

- Online payment: `AWAITING_PAYMENT` → `PAID` → `CONFIRMED` → `PREPARING` → `READY_FOR_PICKUP` (pickup) or `OUT_FOR_DELIVERY` (delivery) → `COMPLETED`.
- Cash: starts at `CONFIRMED`.
- `CANCELLED` if the restaurant cancels the order. `FAILED` if the online payment failed.
- Reservation tokens from `POST /reservations` work here too: `PENDING_APPROVAL`, then `CONFIRMED` or `CANCELLED`.

`order.restaurant.address` is the pickup location: the restaurant's visiting address, or `null`. If you render a map, check both `order.restaurant.trackingShowMap` and `address.latitude`: the owner can turn the map off, and a restaurant without a map point has no coordinates.

The response is `private, no-store`. Rate limits: 60 requests per 60 seconds per IP, and 30 per 60 seconds per token.

Reference: https://docs.lettbestilt.no/api-reference/orders/get-order

## Request

### Path parameters

- `token` (string, required) — The `publicToken` from `POST /orders` or `POST /reservations`.

## Response

### 200

The order.

- `order` (Order, optional)

## Errors

### 400 Bad Request Error

`MISSING_TOKEN`: the token is not in a valid format.

- `error` (ErrorBody, required)

### 404 Not Found Error

`ORDER_NOT_FOUND`: no order has this token.

- `error` (ErrorBody, required)

### 429 Too Many Requests Error

`RATE_LIMITED`: too many requests from this IP or for this token.

- `error` (ErrorBody, required)

## Types

### Order

- `requestedPickupAt` (datetime, optional, nullable) — The agreed pickup or delivery time, and the time to show the customer. The restaurant can move it after the order is placed: if `pickupTimeRevisedAt` is set, this is no longer the time the customer chose.
- `originalRequestedPickupAt` (datetime, optional, nullable) — The time the customer originally chose, frozen the first time the restaurant moves it. `null` means the time has never been moved.
- `pickupTimeRevisedAt` (datetime, optional, nullable) — When the restaurant last moved the time: either the agreed time on a pre-order (`requestedPickupAt`) or, during rush, the estimated ready time on an as-soon-as-possible order (`estimatedReadyAt`, and then `originalRequestedPickupAt` is `null`). Use it to show "the restaurant has changed the time" instead of changing the time silently. `null` means never moved.
- `restaurant` (OrderRestaurant, optional)

### ErrorBody

- `code` (enum, required) — A machine-readable error code.
  - Allowed values: `MISSING_SLUG`, `MISSING_TOKEN`, `INVALID_JSON`, `INVALID_SUCCESS_URL`, `INVALID_CANCEL_URL`, `VALIDATION_FAILED`, `RESTAURANT_NOT_FOUND`, `ORDER_NOT_FOUND`, `RATE_LIMITED`, `BAD_REQUEST`, `UNAUTHORIZED`, `FORBIDDEN`, `POPUP_NOT_AVAILABLE`, `PRICE_CHANGED`, `PAYMENT_INCOMPLETE`, `PAYMENT_PENDING`, `PAYMENT_PROVIDER_INVALID`, `FULFILLMENT_NOT_ALLOWED`, `IDEMPOTENCY_CONFLICT`, `DINE_IN_DISABLED`, `PARTY_TOO_LARGE`, `TOO_EARLY`, `INTERNAL_ERROR`
- `message` (string, required) — A human-readable explanation. Often in Norwegian, and for business rules usually suitable to show the customer.
- `details` (any, optional) — Extra data for some codes, for example `issues` for `VALIDATION_FAILED` or the totals for `PRICE_CHANGED`.

### OrderRestaurant

- `trackingShowMap` (boolean, optional) — The owner's setting for whether the tracking page shows a map to the pickup location.
- `address` (Address, optional, nullable) — The restaurant's public visiting address. Safe to publish: on the contact page, as `address` and `geo` in Restaurant JSON-LD, and as the map point for pickup. The field is `null` when the restaurant has no street address. It is never an empty shell, so `address === null` means "no address to show", not "an address with empty fields". `latitude` and `longitude` are both set or both `null`; check one of them before you render a map.

### Address

The restaurant's public visiting address. Safe to publish: on the contact page, as `address` and `geo` in Restaurant JSON-LD, and as the map point for pickup. The field is `null` when the restaurant has no street address. It is never an empty shell, so `address === null` means "no address to show", not "an address with empty fields". `latitude` and `longitude` are both set or both `null`; check one of them before you render a map.

- `line1` (string, required) — Street address, for example "Heggeliveien 5". Never empty.
- `postalCode` (string, required, nullable) — Four digits, for example "9325".
- `city` (string, required, nullable) — Postal town, for example "Bardufoss".
- `country` (enum, required) — ISO 3166-1 alpha-2. Always "NO".
  - Allowed values: `NO`
- `latitude` (double, required, nullable) — WGS84. Set when the owner picked the address from the address lookup in the dashboard.
- `longitude` (double, required, nullable) — WGS84. Always set together with `latitude`.

## Examples

**Response**

```json
{
  "order": {
    "requestedPickupAt": "2024-01-15T09:30:00Z",
    "originalRequestedPickupAt": "2024-01-15T09:30:00Z",
    "pickupTimeRevisedAt": "2024-01-15T09:30:00Z",
    "restaurant": {
      "trackingShowMap": true,
      "address": {
        "line1": "string",
        "postalCode": "string",
        "city": "string",
        "country": "NO",
        "latitude": 1.1,
        "longitude": 1.1
      }
    }
  }
}
```

**SDK Code**

```python
import requests

url = "https://www.lettbestilt.no/api/v1/orders/token"

response = requests.get(url)

print(response.json())
```

```javascript
const url = 'https://www.lettbestilt.no/api/v1/orders/token';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://www.lettbestilt.no/api/v1/orders/token"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://www.lettbestilt.no/api/v1/orders/token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://www.lettbestilt.no/api/v1/orders/token")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://www.lettbestilt.no/api/v1/orders/token');

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://www.lettbestilt.no/api/v1/orders/token");
var request = new RestRequest(Method.GET);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let request = NSMutableURLRequest(url: NSURL(string: "https://www.lettbestilt.no/api/v1/orders/token")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```