Browser order

GET 
/order/browser

Places a single order with a GET request. The API key goes in the key query parameter instead of the access-key header.

Treat these URLs like passwords. A URL containing an account API key can leak through copied links, browser history and server logs. Opening or refreshing the URL places another order, and it is charged like any other. Do not share these links, and do not assume repeated requests are de-duplicated: refreshes, link previews and retries can each place another order. Prefer POST /order/single with the access-key header for integrations. The IP allow-list applies to this endpoint like every other REST endpoint: a browser-link order from an IP address that is not on your allow-list is blocked, even with a valid key. See the Authentication guide.

This query parameter is named service, not serviceId as in the JSON endpoints.

Request

Responses

200

Single order placed successfully

400

Bad Request — TAC_FAILED, INVALID_IMEI_PROVIDED, SERVICE_ID_MUST_BE_NUMBER, IMEI_REQUIRED (a missing or empty key returns "key should not be empty")

401

Unauthorized — INVALID_API_KEY (the key in the URL is not recognised)

403

Forbidden — YOU_ARE_NOT_ALLOWED, YOU_ARE_BLOCKED, PENDING_FOR_APPROVAL, CREDIT_LIMIT_REACHED, LOW_CREDIT

404

Not Found — SERVICE_NOT_FOUND

405

Method Not Allowed — SERVICE_IS_DISABLED

500

Internal Server Error — unexpected server failure