Look up the order a cart produced

Recovery lookup for a client that lost its Idempotency-Key — after a timeout, a crash, or a closed tab — and needs to learn whether the cart it was checking out was charged.

The cartId is the cart secret returned when the cart was created, and it is the whole credential: no customer authentication is required, and it grants the order that one cart produced and nothing else. The grant is the same one GET /orders/{orderId}?cartId= already accepts, scoped to a single cart, and it lasts as long as the cart record does — it is not separately expired.

data holds at most one order — the latest the cart produced. Both a cart that has not produced an order and a cartId that resolves no cart at all answer an empty data, never a 403 or a 404: a client needs to tell “not charged” apart from “not allowed to ask”, and answering differently for an unknown secret would make this endpoint an oracle for guessing cart secrets.

The order’s status says what to do next. PROCESSING means the payment is still settling, so keep polling. FAILED means the payment did not complete. It is final, so stop polling and let the shopper pay again; their next attempt on the same cart becomes the order this lookup returns. Any other status is the order’s outcome, and GET /orders/{orderId}?cartId= returns that order in full.