# Cancel an order

Cancel an eligible pickup-stage order and verify the returned order code.

Company: Metfone Express
API version: v1
Requested language: en
Content language: en
Source: https://mfexpress-partner-docs.zhst.app/mfexpress/en/cancel-order

Endpoint: DELETE /order/cancel


```http
DELETE /tms-partner/api/v1/order/cancel
```

## Usage and important notes

Send a JSON body even though the method is DELETE. `order_code` is the `id` from create-order. Cancellation is permitted only for internal states **110, 120, 200, 220, 230**, the “pickup in progress” group in the webhook table. The guide also says an order already handed over to the courier or in transport cannot be canceled; use the explicit numeric eligibility list rather than guessing from translated labels.

**Do not rely on HTTP success.** If no order matches for the partner, the source describes `{}` (order_code absent/null), not a clear error. Confirm that the returned `order_code` matches the requested one.

## Authentication headers



| Header | Requirement | Value / meaning |
| --- | --- | --- |
| X-Api-Token | Required | `${API_TOKEN}`: environment-specific token issued by TMS |
| X-Client-Source | Required | `${PARTNER_CODE}`: partner code paired with the token |
| Content-Type | With a JSON body | application/json |
| Accept | Required by source | application/json |
| Accept-Language | Optional | `vn`, `en`, `my`, `km`, `lo` |



## Request fields

Cancellation request with a JSON body.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `order_code` | string | Yes | The id returned by create-order. |



## Example JSON body

Save as `request.json`. Replace every `${…}` string and example ID with actual environment values before sending. cURL with `--data @request.json` **does not interpolate variables inside JSON files**. Identities are synthetic.
```json
{
  "order_code": "EXAMPLE-ORDER-001"
}
```


## cURL example

`BASE_URL` must include `/tms-partner/api/v1`. Load the token and partner code from your private environment; never paste secrets into documentation or AI prompts.
```bash
curl --request DELETE "${BASE_URL}/order/cancel" \
  --header "X-Api-Token: ${API_TOKEN}" \
  --header "X-Client-Source: ${PARTNER_CODE}" \
  --header "Accept-Language: en" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data @request.json
```


## Example response

```json
{
  "order_code": "EXAMPLE-ORDER-001"
}
```


## Response fields



| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `order_code` | string / null | See description | Must match the requested order to confirm cancellation. Absent/null when no partner order matches. |



## Error handling

See [HTTP codes and source limitations](reference). HTTP success does not prove COD, fees, or cancellation are correct; inspect the documented business fields. Do not assume create-order retries are safe.