Order.co

Record your Order.co connection as vendor procurement evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Order.co:

   1. Ask your Order.co Customer Success Manager to turn on API Key Management (Beta) for your organization; it is only available to organizations that have requested access.
   2. As an Order.co Admin, go to Settings and create a named API key. Give it read scopes only, such as spend_history:read, and do not add write scopes such as locations:write.
   3. Copy the token. Order.co API tokens start with ord_ followed by 48 hex characters (52 characters in all).

   Where to find the other values:

   • API token / Personal access token: The API key an Admin creates under Settings (API Key Management, Beta). It is sent as Authorization: Bearer ord_...
   • Base URL (optional): https://app.order.co/api/ (the server in Order.co's published API definition).
   • Account / Org / Workspace (optional): Not needed: each token is scoped to one organization, which Order.co resolves from the token, so no Organization-Id header is required. Leave blank.

   Order.co's public documentation does not cover every step.

   Order.co's release notes (03-21-26) say Admins can create, name, scope and revoke API keys from Settings, starting with the Spend History API, as a beta for organizations that request access through their CSM. The help-center content was read through the Zendesk article API, because the HTML help center returns 403. The scopes and token format come from Order.co's own API definition on SwaggerHub (owner orderco-01c), which the release notes link to. Endpoints: GET /spend_history (spend_history:read), GET /shipments/active, GET /savings/recommendations, and POST/PUT /locations (locations:write). Still missing: the exact submenu and button labels under Settings, and whether the token is shown only once. Order.co also has a legacy Application Key / Secret Key authentication that is documented separately. Verification: the release-notes HTML page returns 403, so it was read through the same article's Zendesk JSON endpoint (ordercompany.zendesk.com/api/v2/help_center/en-us/articles/30967977418903.json); the SwaggerHub uiDocs page returned 404 and the API definition was read from api.swaggerhub.com.

   Source: ordercompany.zendesk.com, app.swaggerhub.com, api.swaggerhub.com, checked 2026-10-07.

2. On Compliance › Connectors, open Order.co, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Order.co yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Vendor Procurement connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks