## POST /api/v2/me/pending-orders/{id}/actions/activate

**Activate pending order**

Activate a pending order the authenticated account owns. This browser session must contain a fresh (at most 15 minutes old), one-time BankID authorization issued specifically for this order. Historical account verification and API keys do not authorize activation. The verified adult must own the private account or be an authorized representative. The account must be Swedish, and the order must be pending, client-triggered, and contain eligible products: hosting or VPS below 3,000, or domains only below 200. Otherwise, pay its invoice instead. No request body is required. On success the response is `{ id, status: "activated", invoiceId }`. When activation is already underway the response is `{ id, status: "activating", invoiceId, skipped: true, reason }`; poll `GET /api/v2/me/pending-orders` until the order leaves the pending snapshot.

### Related Endpoints

- `GET /api/v2/me/pending-orders`: List pending orders
- `GET /api/v2/me`: Get current account profile
- `PATCH /api/v2/me`: Update current account profile

### Headers

- `Accept`: application/json
- `Authorization`: Bearer YOUR_API_KEY
- Required API scope: `write:orders`

### Parameters

- `id` (path, string, required): Public resource ID for `id`. Example: `id_01hxa3b4c5d6e7f8g9h0j1k2m3`

### Request Examples

#### No request body is required

```bash
curl -X POST "https://cloud.hostup.se/api/v2/me/pending-orders/id_01hxa3b4c5d6e7f8g9h0j1k2m3/actions/activate" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"
```

### Response Schema

- `id` (string, required): Public order ID. Example: `ord_01hxa3b4c5d6e7f8g9h0j1k2m3`
- `status` (string, required): `activated` is terminal; `activating` means activation is already in flight.
  Allowed values: activated, activating
- `invoiceId` (string, required, nullable): Public invoice ID of the linked invoice, or null. Example: `inv_01hxa3b4c5d6e7f8g9h0j1k2m3`
- `skipped` (boolean, optional): Present only with `status: "activating"`. Always `true` there: this request did not start a new activation.
- `reason` (string, optional): Present only with `status: "activating"`. Why this request was skipped.
  Allowed values: activation_in_progress, free_order_grace

### Responses

#### 200 - Activation completed (`status: "activated"`) or already underway (`status: "activating"`).
```json
{
  "id": "ord_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "status": "activated",
  "invoiceId": "inv_01hxa3b4c5d6e7f8g9h0j1k2m3"
}
```

#### 400 - Invalid request. The response body is an RFC 7807 Problem Details document.
```json
{
  "type": "https://developer.hostup.se/errors/invalid_request",
  "title": "Invalid request",
  "status": 400,
  "detail": "The request body failed validation.",
  "code": "invalid_request",
  "instance": "/api/v2/resource",
  "requestId": "req_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "timestamp": "2026-04-27T12:34:56.000Z",
  "errors": [
    {
      "pointer": "/items/0/domainName",
      "detail": "`domainName` is required.",
      "code": "invalid_request"
    }
  ]
}
```

#### 401 - Unauthorized. Authentication is required.
```json
{
  "type": "https://developer.hostup.se/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Authentication is required.",
  "code": "unauthorized",
  "instance": "/api/v2/resource",
  "requestId": "req_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "timestamp": "2026-04-27T12:34:56.000Z"
}
```

#### 403 - Forbidden. `bankid_session_required` when the caller is not an interactive browser session, `bankid_activation_not_authorized` when the fresh one-time proof is missing, expired, already used, for another account/order, underage, or not owned by an authorized identity; `not_available_in_country` when the account is not registered in Sweden; or `forbidden` when the session may not place orders for this account.
```json
{
  "type": "https://developer.hostup.se/errors/bankid_activation_not_authorized",
  "title": "Forbidden",
  "status": 403,
  "detail": "A fresh BankID verification by an adult account owner or authorized representative is required. You can still pay the invoice instead.",
  "instance": "/api/v2/me/pending-orders/ord_01hxa3b4c5d6e7f8g9h0j1k2m3/actions/activate",
  "code": "bankid_activation_not_authorized"
}
```

#### 404 - The order does not exist or does not belong to the authenticated account.
```json
{
  "type": "https://developer.hostup.se/errors/order_not_found",
  "title": "Order not found",
  "status": 404,
  "detail": "The requested order could not be found.",
  "instance": "/api/v2/me/pending-orders/ord_01hxa3b4c5d6e7f8g9h0j1k2m3/actions/activate",
  "code": "order_not_found"
}
```

#### 409 - Conflict. `not_pending` when the order is no longer in a pending state, or `activation_blocked` when the order cannot be activated with BankID — open the invoice and pay it instead.
```json
{
  "type": "https://developer.hostup.se/errors/activation_blocked",
  "title": "Conflict",
  "status": 409,
  "detail": "This order can't be activated with BankID. Open the invoice to pay it instead.",
  "instance": "/api/v2/me/pending-orders/ord_01hxa3b4c5d6e7f8g9h0j1k2m3/actions/activate",
  "code": "activation_blocked"
}
```

#### 429 - Rate limited. Retry after the limit resets. 429 responses include `Retry-After` seconds plus `X-RateLimit-*` headers.
```json
{
  "type": "https://developer.hostup.se/errors/rate_limit_exceeded",
  "title": "Too many requests",
  "status": 429,
  "detail": "Too many requests. Retry after the limit resets.",
  "code": "rate_limit_exceeded",
  "instance": "/api/v2/resource",
  "requestId": "req_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "timestamp": "2026-04-27T12:34:56.000Z"
}
```

#### 500 - Internal error. Retry later or contact support if the issue persists.
```json
{
  "type": "https://developer.hostup.se/errors/internal_error",
  "title": "Internal server error",
  "status": 500,
  "detail": "An unexpected error occurred. Retry later or contact support if the issue persists.",
  "code": "internal_error",
  "instance": "/api/v2/resource",
  "requestId": "req_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "timestamp": "2026-04-27T12:34:56.000Z"
}
```