# Create order

Create a new screening order for an applicant against a property. The
property and the applicant can each be supplied either inline (address
/ identity fields) — in which case a new record is created — or by id
(`property_id` / `applicant_id`) to reuse an existing record. Provide
exactly one form per side.
`original_requester` is optional. Omit it entirely if you are screening applicants
for your own organization. Supply it only if you are a platform placing orders on
behalf of your own customers, to identify the end user the report is furnished to.
It follows the same inline-or-id shape, sending both forms returns a validation error,
sending neither does not.
**Screening fee compliance:** many states and cities cap what you may charge an
applicant for a screening fee, or require specific disclosures. You are responsible
for determining and following the application screening fee laws that apply to each
property's jurisdiction. See our [Application Screening
Fees](https://tenant.checkr.com/resources/application-screening-fee) page for
state and city fee caps, provided for reference only and subject to change.

Endpoint: POST /orders
Version: 1.0
Security: bearer-token

## Security:

  - `bearer-token` (unknown)
    http bearer

## Query parameters:

  - `include` (string)
    Comma-separated list of related objects to embed in the response. Supported values:
`property`, `applicant`, `original_requester`. By default only the `property_id`,
`applicant_id` and `original_requester_id` are returned.

## Header parameters:

  - `Idempotency-Key` (string, required)
    Unique, client-generated string (1–255 characters; a UUIDv4 is recommended)
that identifies a single logical request. Generate a fresh key per logical
request; only reuse it when retrying the same request.

In live mode, reusing a key after a successful create returns the original
order and does not create a new, billable one. Keys are retained for that
purpose and do not expire after a short window. Transient errors (5xx) are
not replayed: retrying with the same key will re-execute the request. After
a declined card (`402`), send a new key once the payment method is updated.

In test mode, the header is accepted but does not prevent duplicate orders.
Sending the same key more than once can create multiple `ord_test_` IDs.
See [Testing](testing.md#idempotency-in-test-mode).

  - `Checkr-Tenant-Version` (string)
    CalVer-dated API version to pin behavior to (e.g. `2026-04-29`). When omitted,
the request is served by the newest supported version. Unknown values return 422.

## Request body:

  - `application/json` (unknown)
    The request body for creating a new order. Each side of the order — the
property and the applicant — can be supplied either inline (the address
or identity fields) or by id (a previously created `pr_…` / `ap_…`).
Provide exactly one form per side; sending both, or neither, returns a
validation error.
`original_requester` is optional. Omit it entirely if you are screening applicants
for your own organization. Supply it only if you are a platform placing orders on
behalf of your own customers, to identify the end user the report is furnished to.
It follows the same inline-or-id shape, sending both forms returns a validation error,
sending neither does not.

## Request fields (application/json):

  - `order` (object, required)
    Attributes for the new order.

  - `order.package` (string, required)
    Slug of the screening package to run. Determines which checks are performed and the price charged.
    Enum: "starter", "essential", "complete"

  - `order.property_id` (string)
    Id of an existing property record (e.g. `pr_K9dM2pXqR4vN8tLZbWyHJa`)
owned by your organization. Mutually exclusive with `property`.
Returns 404 if the property does not exist or belongs to
another organization.
    Example: pr_K9dM2pXqR4vN8tLZbWyHJa

  - `order.property` (object)
    Address of the rental property the applicant is being
screened for. Mutually exclusive with `property_id`.
If the address matches an existing property in your
organization, the existing property is reused and no new
record is created — see `POST /properties` for the exact
matching rules. The order's `property_id` in the response
reflects whichever id was used (existing or new).

  - `order.property.name` (string | null)
    Optional human-readable label for the property (e.g. a building or unit nickname). When set, it is shown to applicants and used in email/SMS communications in addition to the property address.
    Example: Sunset Apartments

  - `order.property.street` (string, required)
    Street line of the property address (number and street name).
    Example: 1234 Market St

  - `order.property.unit` (string | null)
    Optional unit, suite, or apartment designator within the building.
    Example: Apt 4B

  - `order.property.city` (string, required)
    City the property is located in.
    Example: San Francisco

  - `order.property.state` (string, required)
    Two-letter USPS state or territory code (uppercase).
    Example: CA

  - `order.property.zipcode` (string, required)
    5-digit US ZIP code or ZIP+4.
    Example: 94103

  - `order.original_requester_id` (string)
    Leave blank unless you are a platform ordering on behalf of
your own customers.
Id of an end user you have already registered (e.g.
`req_TUyYsLnyTbG3xv9hONJF7w`), owned by your organization.
Mutually exclusive with `original_requester`. Returns 404 if
it does not exist, belongs to another organization, or has
been deactivated.
    Example: req_TUyYsLnyTbG3xv9hONJF7w

  - `order.original_requester` (object)
    Leave blank unless you are a platform ordering on behalf of
your own customers. If you screen applicants for your own
organization, omit this field entirely.
Identifies the end user this order is placed on behalf of,
meaning whoever the report is furnished to. Mutually
exclusive with `original_requester_id`.
The address is an individual's physical address, or a
business's place of business. It is optional as a group but
all-or-nothing: either omit the address entirely or send
`street`, `city`, `state` and `zipcode` together. `unit` is
always optional.

  - `order.original_requester.external_id` (string, required)
    A unique identifier assigned to the requester in your
system. Reusing an id you have sent before updates
that requester's details rather than creating a second
record, so the same id must always refer to the same
requester.
    Example: your_customer_42

  - `order.original_requester.type` (string, required)
    Whether this end user is an individual person or a business, such as a property management company.
    Enum: "individual", "business"

  - `order.original_requester.name` (string, required)
    Name this end user does business under. Reported to consumers who request the identity of who procured their report.
    Example: KimCo Property Management

  - `order.original_requester.email` (string)
    Optional contact email for this end user. Not used to contact them.
    Example: ops@kimco.example

  - `order.original_requester.phone_number` (string)
    Optional contact phone number for this end user. US
numbers only. Accepted in any common format (e.g.
`(415) 555-0123`, `415-555-0123`, `+14155550123`) and
returned in E.164.
    Example: 415-555-0123

  - `order.original_requester.street` (string)
    Street line of the end user's address (number and street name).
    Example: 500 Market St

  - `order.original_requester.unit` (string | null)
    Optional unit, suite, or floor designator within the building.
    Example: Floor 8

  - `order.original_requester.city` (string)
    City the end user is located in.
    Example: San Francisco

  - `order.original_requester.state` (string)
    Two-letter USPS state or territory code (uppercase).
    Example: CA

  - `order.original_requester.zipcode` (string)
    5-digit US ZIP code or ZIP+4.
    Example: 94105

  - `order.applicant_id` (string)
    Id of an existing applicant record (e.g. `ap_F3hQ7wEsLp2xBnVcRuMyTk`)
owned by your organization. Mutually exclusive with
`applicant`. Returns 404 if the applicant does not exist or
belongs to another organization, and 422 if the applicant is
already attached to an order — applicants are 1:1 with
orders.
    Example: ap_F3hQ7wEsLp2xBnVcRuMyTk

  - `order.applicant` (object)
    Identity fields for the person being screened. A new
applicant record is created from these fields. Mutually
exclusive with `applicant_id`. `first_name` and `last_name`
are preferred; legacy clients may still send `full_name`
instead. Do not send both name forms. `email` is always
required at create time. If `dob` and/or `ssn` are omitted,
the applicant will be prompted to provide them when they
complete the consent form. Values must match the applicant's
legal identity.

  - `order.applicant.email` (string, required)
    Email address used to contact the applicant about their screening.
    Example: jane@example.com

  - `order.applicant.dob` (string)
    Date of birth in ISO-8601 format (`YYYY-MM-DD`).
    Example: 1990-05-14

  - `order.applicant.phone_number` (string)
    Mobile phone number to contact the applicant about
their screening. US numbers only. Accepted in any
common format (e.g. `(415) 555-0100`, `415-555-0100`,
`+14155550100`); normalized to E.164 before storage.
    Example: 415-555-0100

  - `order.applicant.ssn` (string)
    Applicant's full 9-digit US Social Security Number. Accepted with or without dashes (`123-45-6789` or `123456789`). Subsequent reads only return a masked form.
    Example: 123-45-6789

  - `order.applicant.first_name` (string, required)
    Applicant's given name.
    Example: Jane

  - `order.applicant.last_name` (string, required)
    Applicant's family name.
    Example: Doe

  - `order.applicant.full_name` (string, required)
    Legacy alternative to `first_name` and `last_name`. Mutually exclusive with `first_name` and `last_name`; when split on the first whitespace, it must produce at least two name parts and each resulting part must be 1 to 50 characters.
    Example: Jane Doe

  - `order.add_on_products` (array)
    Optional add-on products to run on the order in
addition to the ones bundled into `package`. Unknown or
non-add-on products return `422 validation_error`.
    Example: ["identity_verification"]

  - `order.payer` (string)
    Who pays for the order: `applicant` or `organization`.
`applicant` requires the applicant to pay, when they reach the payment step
of the apply flow. Live mode only. Not supported for invoiced
organizations. Omit or set to `organization` to use your organization's
default billing.
    Example: organization

## Response 201:

  - `201` (unknown)
    Created

## Response 201 fields (application/json):

  - `id` (string)
    Unique identifier for the order. Use this value in subsequent API calls; it is stable for the lifetime of the order. Test-mode IDs carry a `_test_` infix (e.g. `ord_test_TUyYsLnyTbG3xv9hONJF7w`); live-mode IDs have no infix.
    Example: ord_TUyYsLnyTbG3xv9hONJF7w

  - `live_mode` (boolean)
    Whether this order was created with a live API key (`true`) or a test API key (`false`). Test-mode orders are inert: they route to canned provider responses and do not produce billable activity. See [Testing](/testing) for details.
    Example: true

  - `status` (string)
    Current state of the order in its lifecycle:
* `waiting_for_applicant` — invitation sent; awaiting the applicant's consent and information
* `pending` — applicant submitted consent and information; screening is in progress
* `completed` — screening is complete and the report is available
* `canceled` — terminated before completion
    Enum: "waiting_for_applicant", "pending", "completed", "canceled"

  - `package` (string)
    Slug of the screening package on the order, e.g. `starter`, `essential` or `complete`.

  - `add_on_products` (array)
    Slugs of add-on products run on the order in addition to the ones bundled into `package`. Sorted alphabetically; empty if none were requested.
    Example: ["identity_verification"]

  - `payer` (string)
    Who pays for this order, `applicant` or `organization`. `applicant` is live mode only — always `organization` for test-mode orders.
    Example: organization

  - `property_id` (string)
    Identifier of the property record this order is screening for. Pass `?include=property` to embed the full property object.
    Example: pr_K9dM2pXqR4vN8tLZbWyHJa

  - `applicant_id` (string)
    Identifier of the applicant being screened. Pass `?include=applicant` to embed the full applicant object.
    Example: ap_F3hQ7wEsLp2xBnVcRuMyTk

  - `original_requester_id` (string | null)
    Identifier of the requester you supplied when creating this order, or null if you did not supply one. Pass `?include=original_requester` to embed the full object.
    Example: req_TUyYsLnyTbG3xv9hONJF7w

  - `application_url` (string | null)
    Absolute URL for the applicant apply flow (`https://…/apply/<token>`).
Returned only while the order status is `waiting_for_applicant` — for
live-mode orders, and in test mode only for the Hudson Green
applicant-experience profile (other test applicants auto-submit and skip
the apply flow — see [Testing](/testing#applicant-experience-in-test-mode)).
`null` when status is `pending`, `completed`, or `canceled`, and for
ordinary test-mode profiles. When the apply flow runs, Checkr emails this
link to the applicant; in live mode, if a phone number is present, Checkr
also texts it. Integrators may share `application_url` themselves.
    Example: https://tenant.checkr.com/apply/K7P2MX

  - `property` (object)
    A property record representing the rental address an order is screening for.

  - `property.id` (string)
    Unique identifier for the property record. Use this value in subsequent API calls; it is stable for the lifetime of the property. Test-mode IDs carry a `_test_` infix (e.g. `pr_test_K9dM2pXqR4vN8tLZbWyHJa`); live-mode IDs have no infix.
    Example: pr_K9dM2pXqR4vN8tLZbWyHJa

  - `property.name` (string | null)
    Optional human-readable label for the property (e.g. a building or unit nickname). When set, it is shown to applicants and used in email/SMS communications in addition to the property address.
    Example: Sunset Apartments

  - `property.street` (string)
    Street line of the property address (number and street name).
    Example: 1234 Market St

  - `property.unit` (string | null)
    Optional unit, suite, or apartment designator within the building.
    Example: Apt 4B

  - `property.city` (string)
    City the property is located in.
    Example: San Francisco

  - `property.state` (string)
    Two-letter USPS state or territory code (uppercase).
    Example: CA

  - `property.zipcode` (string)
    5-digit US ZIP code or ZIP+4.
    Example: 94103

  - `property.created_at` (string)
    Timestamp the property record was created.

  - `applicant` (object)
    An applicant record. The full SSN is never returned — only the masked form.

  - `applicant.id` (string)
    Unique identifier for the applicant record. Use this value in subsequent API calls; it is stable for the lifetime of the applicant. Test-mode IDs carry a `_test_` infix (e.g. `ap_test_F3hQ7wEsLp2xBnVcRuMyTk`); live-mode IDs have no infix.
    Example: ap_F3hQ7wEsLp2xBnVcRuMyTk

  - `applicant.full_name` (string)
    Applicant's full legal name as it appears on government-issued ID.
    Example: Jane Public

  - `applicant.email` (string)
    Email address used to contact the applicant about their screening.
    Example: jane@example.com

  - `applicant.first_name` (string)
    Applicant's given name.

  - `applicant.last_name` (string)
    Applicant's family name.

  - `applicant.dob` (string | null)
    Date of birth in ISO-8601 format (`YYYY-MM-DD`). Null if not yet collected.
    Example: 1990-05-14

  - `applicant.phone_number` (string | null)
    Phone number on file for the applicant in E.164 format (US numbers
only), or null if none has been collected. Accepted on input in any
common format (e.g. `(555) 123-4567`, `555-123-4567`); normalized
before storage.
    Example: +15551234567

  - `applicant.ssn` (string | null)
    Masked Social Security Number (last four digits only). Null in responses if no SSN is on file. The full SSN is never returned.
    Example: XXX-XX-6789

  - `applicant.created_at` (string)
    Timestamp the applicant record was created.

  - `original_requester` (object)
    One of your own customers, identified on an order you placed on their
behalf. You create one by sending `original_requester` at order creation,
and identify it afterwards by your own `external_id`.

  - `original_requester.id` (string)
    Checkr Tenant identifier for the requester record.
    Example: req_TUyYsLnyTbG3xv9hONJF7w

  - `original_requester.external_id` (string)
    A unique identifier assigned to the requester in your system.
    Example: your_customer_42

  - `original_requester.type` (string)
    Whether this end user is an individual person or a business.
    Enum: "individual", "business"

  - `original_requester.name` (string)
    Name this end user does business under.
    Example: Acme Property Management, Inc.

  - `original_requester.email` (string | null)
    Contact email for this end user.
    Example: ops@kimco.example

  - `original_requester.phone_number` (string | null)
    Contact phone number for this end user in E.164 format.
    Example: +14155550123

  - `original_requester.street` (string)
    Street line of the end user's address (number and street name).
    Example: 500 Market St

  - `original_requester.unit` (string | null)
    Optional unit, suite, or floor designator within the building.
    Example: Floor 8

  - `original_requester.city` (string)
    City the end user is located in.
    Example: San Francisco

  - `original_requester.state` (string)
    Two-letter USPS state or territory code (uppercase).
    Example: CA

  - `original_requester.zipcode` (string)
    5-digit US ZIP code or ZIP+4.
    Example: 94105

  - `original_requester.created_at` (string)
    Timestamp the requester record was created.

  - `created_at` (string)
    Timestamp the order was accepted by the API.

  - `completed_at` (string | null)
    Timestamp the order reached the `completed` status. Null while in any earlier state, and remains null if the order is canceled.

  - `canceled_at` (string | null)
    Timestamp the order was canceled. Null unless the order was canceled.

## Response 401:

  - `401` (unknown)
    Error response

## Response 401 fields (application/json):

  - `errors` (array)
    One or more errors describing why the request failed.

  - `errors.code` (string)
    Machine-readable error type. Stable across releases; safe to branch on. Possible values:
* `authorization_error` (401)
* `forbidden` (403)
* `not_found_error` (404)
* `validation_error` (422)
* `internal_error` (500)
* `no_payment_method` (402) — no card on file for the organization. Add a card in Settings → Billing, then retry the request.
* `card_declined` (402) — the saved card was declined. Update the card on file or use a different one, then retry the request with a new `Idempotency-Key`.
* `authentication_required` (402) — the saved card requires interactive authentication and cannot be charged. Replace the saved card with one that supports off-session payments.

  - `errors.detail` (string)
    Human-readable explanation of this specific occurrence.

  - `errors.source` (object)
    Pointer to the input that caused the error. Returned for validation errors to identify the offending field; absent otherwise.

  - `errors.source.pointer` (string)
    JSON Pointer path to the offending attribute.
    Example: /email

## Response 402:

  - `402` (unknown)
    Error response

## Response 402 fields (application/json):

  - `errors` (array)
    One or more errors describing why the request failed.

  - `errors.code` (string)
    Machine-readable error type. Stable across releases; safe to branch on. Possible values:
* `authorization_error` (401)
* `forbidden` (403)
* `not_found_error` (404)
* `validation_error` (422)
* `internal_error` (500)
* `no_payment_method` (402) — no card on file for the organization. Add a card in Settings → Billing, then retry the request.
* `card_declined` (402) — the saved card was declined. Update the card on file or use a different one, then retry the request with a new `Idempotency-Key`.
* `authentication_required` (402) — the saved card requires interactive authentication and cannot be charged. Replace the saved card with one that supports off-session payments.

  - `errors.detail` (string)
    Human-readable explanation of this specific occurrence.

  - `errors.source` (object)
    Pointer to the input that caused the error. Returned for validation errors to identify the offending field; absent otherwise.

  - `errors.source.pointer` (string)
    JSON Pointer path to the offending attribute.
    Example: /email

## Response 403:

  - `403` (unknown)
    Error response

## Response 403 fields (application/json):

  - `errors` (array)
    One or more errors describing why the request failed.

  - `errors.code` (string)
    Machine-readable error type. Stable across releases; safe to branch on. Possible values:
* `authorization_error` (401)
* `forbidden` (403)
* `not_found_error` (404)
* `validation_error` (422)
* `internal_error` (500)
* `no_payment_method` (402) — no card on file for the organization. Add a card in Settings → Billing, then retry the request.
* `card_declined` (402) — the saved card was declined. Update the card on file or use a different one, then retry the request with a new `Idempotency-Key`.
* `authentication_required` (402) — the saved card requires interactive authentication and cannot be charged. Replace the saved card with one that supports off-session payments.

  - `errors.detail` (string)
    Human-readable explanation of this specific occurrence.

  - `errors.source` (object)
    Pointer to the input that caused the error. Returned for validation errors to identify the offending field; absent otherwise.

  - `errors.source.pointer` (string)
    JSON Pointer path to the offending attribute.
    Example: /email

## Response 404:

  - `404` (unknown)
    Error response

## Response 404 fields (application/json):

  - `errors` (array)
    One or more errors describing why the request failed.

  - `errors.code` (string)
    Machine-readable error type. Stable across releases; safe to branch on. Possible values:
* `authorization_error` (401)
* `forbidden` (403)
* `not_found_error` (404)
* `validation_error` (422)
* `internal_error` (500)
* `no_payment_method` (402) — no card on file for the organization. Add a card in Settings → Billing, then retry the request.
* `card_declined` (402) — the saved card was declined. Update the card on file or use a different one, then retry the request with a new `Idempotency-Key`.
* `authentication_required` (402) — the saved card requires interactive authentication and cannot be charged. Replace the saved card with one that supports off-session payments.

  - `errors.detail` (string)
    Human-readable explanation of this specific occurrence.

  - `errors.source` (object)
    Pointer to the input that caused the error. Returned for validation errors to identify the offending field; absent otherwise.

  - `errors.source.pointer` (string)
    JSON Pointer path to the offending attribute.
    Example: /email

## Response 422:

  - `422` (unknown)
    Error response

## Response 422 fields (application/json):

  - `errors` (array)
    One or more errors describing why the request failed.

  - `errors.code` (string)
    Machine-readable error type. Stable across releases; safe to branch on. Possible values:
* `authorization_error` (401)
* `forbidden` (403)
* `not_found_error` (404)
* `validation_error` (422)
* `internal_error` (500)
* `no_payment_method` (402) — no card on file for the organization. Add a card in Settings → Billing, then retry the request.
* `card_declined` (402) — the saved card was declined. Update the card on file or use a different one, then retry the request with a new `Idempotency-Key`.
* `authentication_required` (402) — the saved card requires interactive authentication and cannot be charged. Replace the saved card with one that supports off-session payments.

  - `errors.detail` (string)
    Human-readable explanation of this specific occurrence.

  - `errors.source` (object)
    Pointer to the input that caused the error. Returned for validation errors to identify the offending field; absent otherwise.

  - `errors.source.pointer` (string)
    JSON Pointer path to the offending attribute.
    Example: /email