> ## Documentation index > Fetch the complete documentation index at: https://developer.rhombus.com/llms.txt > Use it to discover all available pages before exploring further. # Accept a quoted license order into the MSP pool > MSP only. Step 2 of 2 (D28-D30): records the partner's acknowledgement (checkbox, typed signature, the quote total / currency / terms version as shown; the server adds the accepting user's name and email, the time, client IP and user agent) on the pool opportunity. Salesforce then bills the order, mints the claim key and the licenses land in the pool with no further call (poll getPool). Answers 202 ORDER_SUBMITTED, also when the order had already been accepted (replay). The daily cap is consumed here. On success an audit event carries the acknowledgement and a receipt email with the lines, prices, term dates, auto-renew terms and acceptance time goes to the accepting user and the MSP admins. Errors: 400 ACKNOWLEDGEMENT_REQUIRED (agreed false), SIGNATURE_REQUIRED (blank), PROVISION_CAP_EXCEEDED (detail = remainingToday), SELF_PROVISIONING_DISABLED; 403 NOT_VERIFIED_MSP, ORDER_NOT_YOURS; 404 ORDER_NOT_FOUND; 409 QUOTE_CHANGED (total, currency or terms version differ from the quote on record); 410 QUOTE_EXPIRED (also for a cancelled or otherwise closed quote); 503 SALESFORCE_UNAVAILABLE (acceptance NOT recorded; retry, idempotent on orderId). No claim code ever appears in any response. ```http POST https://api2.rhombussystems.com/api/partner/license/acceptPoolOrder ``` EU organizations send the same request to `https://api2.eu.rhombussystems.com`. ## Authentication and parameters - `x-auth-apikey` (header, required): Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). - `Authorization` (header): instead of an API key, an OAuth access token (`Bearer `) with the `write` scope. - `x-auth-scheme` (header, string, default: `partner-api-token`): Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters. One of: `api-token`, `api`, `api-oauth-token`, `federated-token`, `partner-api-token`, `partner-api`, `partner-api-oauth-token`. - `x-auth-org` (header, string): Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`. ## Request body Content type: `application/json`. Accept a quoted pool order on behalf of the MSP: records the acknowledgement (typed name + checkbox) on the Salesforce quote, after which Salesforce bills it, mints the claim key and emails it to the partner, who claims it into the pool. - `acknowledgement` (object): The partner's acknowledgement of a quote (D29, contract v2.3): the checkbox and the typed name. Recorded on the Salesforce quote as Customer_Name__c + Customer_Acknowledged__c (field history keeps who / when). - `orderId` (string | null): orderId from quotePoolOrder (the Salesforce opportunity id). Must be this partner's, QUOTED, calculated and unexpired. - `requestId` (string | null): The client request id the quote was asked under (optional; when given it must be the order's). ## Response 202 Order submitted. Content type: `application/json` - `acceptedAtMillis` (integer | null): Server time of the acceptance when THIS call recorded it; null on a replay (Salesforce keeps the who / when in the quote's field history). - `acceptedByEmail` (string | null): Email of the session user who accepted when THIS call recorded it; null on a replay. - `customerName` (string | null): The typed name as recorded on the quote (Customer_Name__c). - `error` (boolean | null) - `errorCode` (string | null): Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. - `errorMsg` (string | null) - `orderId` (string | null) - `replay` (boolean | null): True when this order had already been acknowledged; nothing was recorded again. - `requestId` (string | null) - `state` (string | null): ORDER_SUBMITTED. Apex advances the opportunity and mints the key; getPool.orders[] shows the stage and key state. - `warningMsg` (string | null) ## Errors Also 400, 401, 403, 429, 500, 503 with the standard error body (`errorCode`, `errorMsg`): https://developer.rhombus.com/errors ## OpenAPI ````yaml openapi: 3.0.1 info: title: Rhombus API version: "1.0" servers: - description: Production Server url: https://api2.rhombussystems.com security: - ApiKeyAuth: [] paths: /api/partner/license/acceptPoolOrder: post: description: "MSP only. Step 2 of 2 (D28-D30): records the partner's acknowledgement (checkbox, typed signature, the quote total / currency / terms version as shown; the server adds the accepting user's name and email, the time, client IP and user agent) on the pool opportunity. Salesforce then bills the order, mints the claim key and the licenses land in the pool with no further call (poll getPool). Answers 202 ORDER_SUBMITTED, also when the order had already been accepted (replay). The daily cap is consumed here. On success an audit event carries the acknowledgement and a receipt email with the lines, prices, term dates, auto-renew terms and acceptance time goes to the accepting user and the MSP admins. Errors: 400 ACKNOWLEDGEMENT_REQUIRED (agreed false), SIGNATURE_REQUIRED (blank), PROVISION_CAP_EXCEEDED (detail = remainingToday), SELF_PROVISIONING_DISABLED; 403 NOT_VERIFIED_MSP, ORDER_NOT_YOURS; 404 ORDER_NOT_FOUND; 409 QUOTE_CHANGED (total, currency or terms version differ from the quote on record); 410 QUOTE_EXPIRED (also for a cancelled or otherwise closed quote); 503 SALESFORCE_UNAVAILABLE (acceptance NOT recorded; retry, idempotent on orderId). No claim code ever appears in any response." operationId: acceptPoolOrder parameters: - description: "Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer ` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters." example: partner-api-token in: header name: x-auth-scheme required: false schema: default: partner-api-token enum: - api-token - api - api-oauth-token - federated-token - partner-api-token - partner-api - partner-api-oauth-token type: string - description: "Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`." in: header name: x-auth-org required: false schema: format: RUUID maxLength: 22 minLength: 22 type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/Partner_msp_AcceptPoolOrderWSRequest" responses: "202": content: application/json: schema: $ref: "#/components/schemas/Partner_msp_AcceptPoolOrderWSResponse" description: Order submitted "400": $ref: "#/components/responses/BadRequest" "401": $ref: "#/components/responses/Unauthorized" "403": $ref: "#/components/responses/Forbidden" "429": $ref: "#/components/responses/TooManyRequests" "500": $ref: "#/components/responses/InternalServerError" "503": $ref: "#/components/responses/ServiceUnavailable" security: - ApiKeyAuth: [] - oauth2: - write summary: Accept a quoted license order into the MSP pool tags: - Partner Webservice components: schemas: Partner_msp_AcceptPoolOrderWSRequest: description: "Accept a quoted pool order on behalf of the MSP: records the acknowledgement (typed name + checkbox) on the Salesforce quote, after which Salesforce bills it, mints the claim key and emails it to the partner, who claims it into the pool." properties: acknowledgement: $ref: "#/components/schemas/Partner_msp_PoolOrderAcknowledgementWSType" orderId: description: orderId from quotePoolOrder (the Salesforce opportunity id). Must be this partner's, QUOTED, calculated and unexpired. nullable: true type: string requestId: description: The client request id the quote was asked under (optional; when given it must be the order's). nullable: true type: string type: object Partner_msp_PoolOrderAcknowledgementWSType: description: "The partner's acknowledgement of a quote (D29, contract v2.3): the checkbox and the typed name. Recorded on the Salesforce quote as Customer_Name__c + Customer_Acknowledged__c (field history keeps who / when)." properties: agreed: description: '"I have reviewed and agree to these terms on behalf of "; must be true (400 ACKNOWLEDGEMENT_REQUIRED).' nullable: true type: boolean typedName: description: The accepting person's typed name; must not be blank (400 SIGNATURE_REQUIRED). Stored as the quote's customer name. nullable: true type: string type: object Partner_msp_AcceptPoolOrderWSResponse: description: "202: the acknowledgement is recorded on the pool opportunity's quote and Salesforce is advancing it; the claim key is emailed to the partner later and claimed in the console (poll getPool for the order's stage). Never carries a claim code or key." properties: acceptedAtMillis: description: Server time of the acceptance when THIS call recorded it; null on a replay (Salesforce keeps the who / when in the quote's field history). format: int64 nullable: true type: integer acceptedByEmail: description: Email of the session user who accepted when THIS call recorded it; null on a replay. nullable: true type: string customerName: description: The typed name as recorded on the quote (Customer_Name__c). nullable: true type: string error: nullable: true type: boolean errorCode: description: Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg. nullable: true type: string errorMsg: nullable: true type: string orderId: nullable: true type: string replay: description: True when this order had already been acknowledged; nothing was recorded again. nullable: true type: boolean requestId: nullable: true type: string state: description: ORDER_SUBMITTED. Apex advances the opportunity and mints the key; getPool.orders[] shows the stage and key state. nullable: true type: string warningMsg: nullable: true type: string type: object securitySchemes: ApiKeyAuth: description: Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints). in: header name: x-auth-apikey type: apiKey oauth2: description: 'OAuth 2.0 authorization code flow with PKCE (`S256`). Send the access token as `Authorization: Bearer `. Each operation lists the scopes it requires; a token without them is refused 403 with `WWW-Authenticate: Bearer error="insufficient_scope"`.' flows: authorizationCode: authorizationUrl: https://console.rhombus.com/oauth/authorize refreshUrl: https://auth-web.rhombussystems.com/oauth/token scopes: physical: Unlock doors and elevators, lockdown, alarms, speakers and robots read: View cameras, footage and settings write: Change settings and data tokenUrl: https://auth-web.rhombussystems.com/oauth/token type: oauth2 ````