# List orders

List the orders owned by your organization, newest first. The response
is paginated — see `next_href` / `previous_href` for walking through
pages. Live-mode keys see only live-mode orders; test-mode keys see
only test-mode orders.

Endpoint: GET /orders
Version: 1.0
Security: bearer-token

## Security:

  - `bearer-token` (unknown)
    http bearer

## Query parameters:

  - `cursor` (string)
    Opaque pagination token. Omit on the first request, then follow the
`next_href` and `previous_href` URLs in the response — those URLs already
have the correct cursor encoded. Cursors from one endpoint are not valid
on another. An invalid cursor returns 422.

  - `per_page` (integer)
    Page size. Defaults to 25; the maximum is 100. The chosen size is preserved
on `next_href` and `previous_href`, so you only need to set it on the first
request of a walk.

  - `include` (string)
    Comma-separated list of related objects to embed in the response. Supported values:
`property`, `applicant`, `original_requester`. By default only the `property_id`,
`applicant_id` and `original_requester_id` are returned.

## Header parameters:

  - `Checkr-Tenant-Version` (string)
    CalVer-dated API version to pin behavior to (e.g. `2026-04-29`). When omitted,
the request is served by the newest supported version. Unknown values return 422.

## Response 200:

  - `200` (unknown)
    OK

## Response 200 fields (application/json):

  - `object` (string)
    Always `list` for list responses.
    Enum: "list"

  - `count` (integer)
    Total number of records in the underlying collection (across all pages), not the size of `data`.

  - `next_href` (string | null)
    Absolute URL of the next page (older records), or `null` if this is the last page.

  - `previous_href` (string | null)
    Absolute URL of the previous page (newer records), or `null` if this is the first page.

  - `data` (array)
    Orders on this page, ordered newest first.

  - `data.id` (string)
    Unique identifier for the order. Use this value in subsequent API calls; it is stable for the lifetime of the order. Test-mode IDs carry a `_test_` infix (e.g. `ord_test_TUyYsLnyTbG3xv9hONJF7w`); live-mode IDs have no infix.
    Example: ord_TUyYsLnyTbG3xv9hONJF7w

  - `data.live_mode` (boolean)
    Whether this order was created with a live API key (`true`) or a test API key (`false`). Test-mode orders are inert: they route to canned provider responses and do not produce billable activity. See [Testing](/testing) for details.
    Example: true

  - `data.status` (string)
    Current state of the order in its lifecycle:
* `waiting_for_applicant` — invitation sent; awaiting the applicant's consent and information
* `pending` — applicant submitted consent and information; screening is in progress
* `completed` — screening is complete and the report is available
* `canceled` — terminated before completion
    Enum: "waiting_for_applicant", "pending", "completed", "canceled"

  - `data.package` (string)
    Slug of the screening package on the order, e.g. `starter`, `essential` or `complete`.

  - `data.add_on_products` (array)
    Slugs of add-on products run on the order in addition to the ones bundled into `package`. Sorted alphabetically; empty if none were requested.
    Example: ["identity_verification"]

  - `data.payer` (string)
    Who pays for this order, `applicant` or `organization`. `applicant` is live mode only — always `organization` for test-mode orders.
    Example: organization

  - `data.property_id` (string)
    Identifier of the property record this order is screening for. Pass `?include=property` to embed the full property object.
    Example: pr_K9dM2pXqR4vN8tLZbWyHJa

  - `data.applicant_id` (string)
    Identifier of the applicant being screened. Pass `?include=applicant` to embed the full applicant object.
    Example: ap_F3hQ7wEsLp2xBnVcRuMyTk

  - `data.original_requester_id` (string | null)
    Identifier of the requester you supplied when creating this order, or null if you did not supply one. Pass `?include=original_requester` to embed the full object.
    Example: req_TUyYsLnyTbG3xv9hONJF7w

  - `data.application_url` (string | null)
    Absolute URL for the applicant apply flow (`https://…/apply/<token>`).
Returned only while the order status is `waiting_for_applicant` — for
live-mode orders, and in test mode only for the Hudson Green
applicant-experience profile (other test applicants auto-submit and skip
the apply flow — see [Testing](/testing#applicant-experience-in-test-mode)).
`null` when status is `pending`, `completed`, or `canceled`, and for
ordinary test-mode profiles. When the apply flow runs, Checkr emails this
link to the applicant; in live mode, if a phone number is present, Checkr
also texts it. Integrators may share `application_url` themselves.
    Example: https://tenant.checkr.com/apply/K7P2MX

  - `data.property` (object)
    A property record representing the rental address an order is screening for.

  - `data.property.id` (string)
    Unique identifier for the property record. Use this value in subsequent API calls; it is stable for the lifetime of the property. Test-mode IDs carry a `_test_` infix (e.g. `pr_test_K9dM2pXqR4vN8tLZbWyHJa`); live-mode IDs have no infix.
    Example: pr_K9dM2pXqR4vN8tLZbWyHJa

  - `data.property.name` (string | null)
    Optional human-readable label for the property (e.g. a building or unit nickname). When set, it is shown to applicants and used in email/SMS communications in addition to the property address.
    Example: Sunset Apartments

  - `data.property.street` (string)
    Street line of the property address (number and street name).
    Example: 1234 Market St

  - `data.property.unit` (string | null)
    Optional unit, suite, or apartment designator within the building.
    Example: Apt 4B

  - `data.property.city` (string)
    City the property is located in.
    Example: San Francisco

  - `data.property.state` (string)
    Two-letter USPS state or territory code (uppercase).
    Example: CA

  - `data.property.zipcode` (string)
    5-digit US ZIP code or ZIP+4.
    Example: 94103

  - `data.property.created_at` (string)
    Timestamp the property record was created.

  - `data.applicant` (object)
    An applicant record. The full SSN is never returned — only the masked form.

  - `data.applicant.id` (string)
    Unique identifier for the applicant record. Use this value in subsequent API calls; it is stable for the lifetime of the applicant. Test-mode IDs carry a `_test_` infix (e.g. `ap_test_F3hQ7wEsLp2xBnVcRuMyTk`); live-mode IDs have no infix.
    Example: ap_F3hQ7wEsLp2xBnVcRuMyTk

  - `data.applicant.full_name` (string)
    Applicant's full legal name as it appears on government-issued ID.
    Example: Jane Public

  - `data.applicant.email` (string)
    Email address used to contact the applicant about their screening.
    Example: jane@example.com

  - `data.applicant.first_name` (string)
    Applicant's given name.

  - `data.applicant.last_name` (string)
    Applicant's family name.

  - `data.applicant.dob` (string | null)
    Date of birth in ISO-8601 format (`YYYY-MM-DD`). Null if not yet collected.
    Example: 1990-05-14

  - `data.applicant.phone_number` (string | null)
    Phone number on file for the applicant in E.164 format (US numbers
only), or null if none has been collected. Accepted on input in any
common format (e.g. `(555) 123-4567`, `555-123-4567`); normalized
before storage.
    Example: +15551234567

  - `data.applicant.ssn` (string | null)
    Masked Social Security Number (last four digits only). Null in responses if no SSN is on file. The full SSN is never returned.
    Example: XXX-XX-6789

  - `data.applicant.created_at` (string)
    Timestamp the applicant record was created.

  - `data.original_requester` (object)
    One of your own customers, identified on an order you placed on their
behalf. You create one by sending `original_requester` at order creation,
and identify it afterwards by your own `external_id`.

  - `data.original_requester.id` (string)
    Checkr Tenant identifier for the requester record.
    Example: req_TUyYsLnyTbG3xv9hONJF7w

  - `data.original_requester.external_id` (string)
    A unique identifier assigned to the requester in your system.
    Example: your_customer_42

  - `data.original_requester.type` (string)
    Whether this end user is an individual person or a business.
    Enum: "individual", "business"

  - `data.original_requester.name` (string)
    Name this end user does business under.
    Example: Acme Property Management, Inc.

  - `data.original_requester.email` (string | null)
    Contact email for this end user.
    Example: ops@kimco.example

  - `data.original_requester.phone_number` (string | null)
    Contact phone number for this end user in E.164 format.
    Example: +14155550123

  - `data.original_requester.street` (string)
    Street line of the end user's address (number and street name).
    Example: 500 Market St

  - `data.original_requester.unit` (string | null)
    Optional unit, suite, or floor designator within the building.
    Example: Floor 8

  - `data.original_requester.city` (string)
    City the end user is located in.
    Example: San Francisco

  - `data.original_requester.state` (string)
    Two-letter USPS state or territory code (uppercase).
    Example: CA

  - `data.original_requester.zipcode` (string)
    5-digit US ZIP code or ZIP+4.
    Example: 94105

  - `data.original_requester.created_at` (string)
    Timestamp the requester record was created.

  - `data.created_at` (string)
    Timestamp the order was accepted by the API.

  - `data.completed_at` (string | null)
    Timestamp the order reached the `completed` status. Null while in any earlier state, and remains null if the order is canceled.

  - `data.canceled_at` (string | null)
    Timestamp the order was canceled. Null unless the order was canceled.

## Response 401:

  - `401` (unknown)
    Error response

## Response 401 fields (application/json):

  - `errors` (array)
    One or more errors describing why the request failed.

  - `errors.code` (string)
    Machine-readable error type. Stable across releases; safe to branch on. Possible values:
* `authorization_error` (401)
* `forbidden` (403)
* `not_found_error` (404)
* `validation_error` (422)
* `internal_error` (500)
* `no_payment_method` (402) — no card on file for the organization. Add a card in Settings → Billing, then retry the request.
* `card_declined` (402) — the saved card was declined. Update the card on file or use a different one, then retry the request with a new `Idempotency-Key`.
* `authentication_required` (402) — the saved card requires interactive authentication and cannot be charged. Replace the saved card with one that supports off-session payments.

  - `errors.detail` (string)
    Human-readable explanation of this specific occurrence.

  - `errors.source` (object)
    Pointer to the input that caused the error. Returned for validation errors to identify the offending field; absent otherwise.

  - `errors.source.pointer` (string)
    JSON Pointer path to the offending attribute.
    Example: /email

## Response 403:

  - `403` (unknown)
    Error response

## Response 403 fields (application/json):

  - `errors` (array)
    One or more errors describing why the request failed.

  - `errors.code` (string)
    Machine-readable error type. Stable across releases; safe to branch on. Possible values:
* `authorization_error` (401)
* `forbidden` (403)
* `not_found_error` (404)
* `validation_error` (422)
* `internal_error` (500)
* `no_payment_method` (402) — no card on file for the organization. Add a card in Settings → Billing, then retry the request.
* `card_declined` (402) — the saved card was declined. Update the card on file or use a different one, then retry the request with a new `Idempotency-Key`.
* `authentication_required` (402) — the saved card requires interactive authentication and cannot be charged. Replace the saved card with one that supports off-session payments.

  - `errors.detail` (string)
    Human-readable explanation of this specific occurrence.

  - `errors.source` (object)
    Pointer to the input that caused the error. Returned for validation errors to identify the offending field; absent otherwise.

  - `errors.source.pointer` (string)
    JSON Pointer path to the offending attribute.
    Example: /email

## Response 422:

  - `422` (unknown)
    Error response

## Response 422 fields (application/json):

  - `errors` (array)
    One or more errors describing why the request failed.

  - `errors.code` (string)
    Machine-readable error type. Stable across releases; safe to branch on. Possible values:
* `authorization_error` (401)
* `forbidden` (403)
* `not_found_error` (404)
* `validation_error` (422)
* `internal_error` (500)
* `no_payment_method` (402) — no card on file for the organization. Add a card in Settings → Billing, then retry the request.
* `card_declined` (402) — the saved card was declined. Update the card on file or use a different one, then retry the request with a new `Idempotency-Key`.
* `authentication_required` (402) — the saved card requires interactive authentication and cannot be charged. Replace the saved card with one that supports off-session payments.

  - `errors.detail` (string)
    Human-readable explanation of this specific occurrence.

  - `errors.source` (object)
    Pointer to the input that caused the error. Returned for validation errors to identify the offending field; absent otherwise.

  - `errors.source.pointer` (string)
    JSON Pointer path to the offending attribute.
    Example: /email