# Business Made · Work orders Part of AppEngine API Documentation. Full index: https://appengine.appmint.io/documentation.md ## GET /business-made/work-orders **List work orders** `operationId: WorkOrderController_getWorkOrders` Work orders across the org. #### Signature ```http GET /business-made/work-orders (page?: integer, pageSize?: integer) -> Work orders ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/work-orders/active` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `page` | query | integer | — | | | `pageSize` | query | integer | — | | ### Responses | Status | Meaning | | --- | --- | | `200` | Work orders | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/work-orders **Create a work order** `operationId: WorkOrderController_createWorkOrder` Raises a work order for a customer or asset. #### Signature ```http POST /business-made/work-orders (body) -> The created work order ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/assign` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Request body The work order to create. ```json { "customerId": "cus_4821", "description": "Annual boiler service", "scheduledDate": "2026-10-08" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The created work order | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/work-orders/active **List active work orders** `operationId: WorkOrderController_getActiveWorkOrders` Work currently in progress — the dispatch board. #### Signature ```http GET /business-made/work-orders/active () -> Active work orders ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/assign` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Responses | Status | Meaning | | --- | --- | | `200` | Active work orders | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/work-orders/{id} **Get a work order** `operationId: WorkOrderController_getWorkOrder` Fetches one work order with its items, time entries and materials. #### Signature ```http GET /business-made/work-orders/{id} (id: string) -> The work order ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/status` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `200` | The work order | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## DELETE /business-made/work-orders/{id} **Delete a work order** `operationId: WorkOrderController_deleteWorkOrder` Deletes a work order and the time and materials recorded against it — which is also the billing evidence. #### Signature ```http DELETE /business-made/work-orders/{id} (id: string) -> Deletion result ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Notes - Destroys the record of work done and materials used. #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/status` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `200` | Deletion result | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/work-orders/update **Update a work order** `operationId: WorkOrderController_updateWorkOrder` Updates a work order. Status and assignment have dedicated endpoints. #### Signature ```http POST /business-made/work-orders/update (body) -> The updated work order ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/status` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Request body The work order to update. ```json { "id": "WO-4821", "scheduledDate": "2026-10-10" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated work order | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/work-orders/{id}/status **Change a work order status** `operationId: WorkOrderController_updateWorkOrderStatus` Moves a work order through its lifecycle — scheduled, in progress, complete. #### Signature ```http POST /business-made/work-orders/{id}/status (id: string, body) -> The updated work order ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Work order not found | No work order has that id. | — | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/assign` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Request body The new status. ```json { "status": "in-progress" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated work order | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Work order not found — No work order has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/work-orders/{id}/assign **Assign a work order** `operationId: WorkOrderController_assignWorkOrder` Assigns the work to one or more people. Replaces the existing assignment rather than adding to it — send the full list. #### Signature ```http POST /business-made/work-orders/{id}/assign (id: string, body) -> The updated work order ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Notes - `assignedTo` replaces the current assignment. #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Work order not found | No work order has that id. | — | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/work-orders/active` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Request body Who to assign it to. ```json { "assignedTo": [ "EMP-4821", "EMP-4822" ] } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated work order | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Work order not found — No work order has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/work-orders/{id}/items **Add a work order item** `operationId: WorkOrderController_addWorkOrderItem` Adds a line of work to the order. #### Signature ```http POST /business-made/work-orders/{id}/items (id: string, body) -> The updated work order ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Work order not found | No work order has that id. | — | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/items/{itemId}` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Request body The item to add. ```json { "description": "Replace pressure valve", "quantity": 1, "rate": 85 } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated work order | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Work order not found — No work order has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/work-orders/{id}/items/{itemId} **Update a work order item** `operationId: WorkOrderController_updateWorkOrderItem` Updates one line on a work order. #### Signature ```http POST /business-made/work-orders/{id}/items/{itemId} (id: string, itemId: string, body) -> The updated work order ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Work order not found | No work order has that id. | — | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/items` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | | `itemId` | path | string | yes | Item id. | ### Request body Fields to change. ```json { "quantity": 2 } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated work order | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Work order not found — No work order has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/work-orders/{id}/time-entries **Add a time entry** `operationId: WorkOrderController_addTimeEntry` Records labour time against a work order. This is what makes the job billable and what the margin on it is measured from. #### Signature ```http POST /business-made/work-orders/{id}/time-entries (id: string, body) -> The updated work order ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Work order not found | No work order has that id. | — | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/materials` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Request body The time entry. ```json { "employeeId": "EMP-4821", "hours": 2.5, "date": "2026-10-08", "rate": 65 } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated work order | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Work order not found — No work order has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/work-orders/{id}/materials **Add materials** `operationId: WorkOrderController_addMaterial` Records materials consumed on a work order — the cost side of the job. #### Signature ```http POST /business-made/work-orders/{id}/materials (id: string, body) -> The updated work order ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Work order not found | No work order has that id. | — | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/work-orders/{id}/time-entries` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Request body The materials used. ```json { "sku": "PRT-VALVE-22", "quantity": 1, "unitCost": 42.5 } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated work order | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Work order not found — No work order has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/work-orders/customer/{customerId} **Get a customer's work orders** `operationId: WorkOrderController_getWorkOrdersByCustomer` Work orders raised for one customer — their service history. #### Signature ```http GET /business-made/work-orders/customer/{customerId} (customerId: string) -> Work orders ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/work-orders` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `customerId` | path | string | yes | Customer id. | ### Responses | Status | Meaning | | --- | --- | | `200` | Work orders | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |