> ## Documentation Index
> Fetch the complete documentation index at: https://docs.server.express/llms.txt
> Use this file to discover all available pages before exploring further.

# Buy a specific in-stock dedicated server

> The one-off path: a TenantOS machine sitting in stock rather than a plan. Re-reads the machine from TenantOS to confirm
it's still for sale and to take its price, applies any reseller discount and coupon, then creates a PENDING monthly
service and an UNPAID invoice due in 7 days. The root password is sealed, never stored in the clear. The OS install is a
work order for staff. Writes a BUY_DEDICATED audit log entry and notifies staff on Discord and Telegram. A coupon that
ran out between quote and commit returns 409. Unexpected failures return 500 with the underlying error message.
Requires a complete billing address (428).



## OpenAPI

````yaml /api-reference/openapi.yaml post /v1/client/dedicated/buy
openapi: 3.1.0
info:
  title: Server.Express API
  version: 1.0.0
  description: >-
    The customer-facing Server.Express API: auth, billing, tickets, cloud and
    dedicated servers, hosting, reselling and account management. Every response
    uses the `{ success, data | error }` envelope.
  contact:
    name: Server.Express
    url: https://server.express
servers:
  - url: https://my.server.express/api
    description: Production
security:
  - bearerAuth: []
  - apiToken: []
tags:
  - name: API Tokens
  - name: Account
  - name: Auth
  - name: Cloud
  - name: Coupons
  - name: Credits
  - name: Dashboard
  - name: Dedicated
  - name: Health
  - name: Hosting
  - name: Integrations
  - name: Invoices
  - name: Livechat
  - name: Notifications
  - name: Passkeys
  - name: Payments
  - name: Products
  - name: Public
  - name: Public Invoices
  - name: Public Tools
  - name: Reseller
  - name: SSH Keys
  - name: Services
  - name: Tasks
  - name: Teams
  - name: Tickets
  - name: Web Hosting
  - name: Webhooks
paths:
  /v1/client/dedicated/buy:
    post:
      tags:
        - Dedicated
      summary: Buy a specific in-stock dedicated server
      description: >-
        The one-off path: a TenantOS machine sitting in stock rather than a
        plan. Re-reads the machine from TenantOS to confirm

        it's still for sale and to take its price, applies any reseller discount
        and coupon, then creates a PENDING monthly

        service and an UNPAID invoice due in 7 days. The root password is
        sealed, never stored in the clear. The OS install is a

        work order for staff. Writes a BUY_DEDICATED audit log entry and
        notifies staff on Discord and Telegram. A coupon that

        ran out between quote and commit returns 409. Unexpected failures return
        500 with the underlying error message.

        Requires a complete billing address (428).
      operationId: publicClientBuyStockDedicated
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - tenantosId
                - hostname
                - profileId
              properties:
                tenantosId:
                  type: string
                  description: >-
                    TenantOS server id, from GET
                    /v1/client/dedicated/marketplace.
                hostname:
                  type: string
                  minLength: 1
                profileId:
                  type: integer
                  description: Install profile id, from GET /v1/client/dedicated/profiles.
                rootPassword:
                  type: string
                sshKeys:
                  type: array
                  items:
                    type: string
                  description: Public keys to install.
                couponCode:
                  type: string
      responses:
        '200':
          description: Order placed.
          content:
            application/json:
              schema:
                type: object
                required:
                  - success
                  - data
                properties:
                  success:
                    type: boolean
                    const: true
                  data:
                    $ref: '#/components/schemas/PublicClientOrderResult'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '428':
          description: The account has no complete billing address yet.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicClientBillingDetailsRequired'
        '500':
          $ref: '#/components/responses/ServerError'
      security:
        - bearerAuth: []
components:
  schemas:
    PublicClientOrderResult:
      type: object
      required:
        - serviceId
        - invoiceId
        - invoiceNumber
        - total
        - currency
      properties:
        serviceId:
          type: string
          format: uuid
        invoiceId:
          type: string
          format: uuid
        invoiceNumber:
          type: string
        total:
          type: integer
          description: Invoice total including tax, minor units.
        currency:
          type: string
    PublicClientBillingDetailsRequired:
      type: object
      description: >-
        428 Precondition Required — add the listed billing fields before
        ordering or paying.
      required:
        - success
        - error
        - data
      properties:
        success:
          type: boolean
          const: false
        error:
          type: string
        data:
          type: object
          required:
            - billingDetailsRequired
            - missing
          properties:
            billingDetailsRequired:
              type: boolean
              const: true
            missing:
              type: array
              items:
                type: string
                enum:
                  - addressLine1
                  - city
                  - postcode
                  - country
                  - companyName
    ErrorResponse:
      type: object
      required:
        - success
        - error
      properties:
        success:
          type: boolean
          const: false
        error:
          type: string
          description: Human-readable error message.
      additionalProperties: true
  responses:
    BadRequest:
      description: Validation failed or the request is malformed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing, invalid or expired credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: >-
        Authenticated but not allowed (missing scope, not an admin, or not your
        resource).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: The request conflicts with the resource's current state.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ServerError:
      description: Unexpected server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh.
        A session satisfies every API scope.
    apiToken:
      type: http
      scheme: bearer
      bearerFormat: se_live_<prefix>_<secret>
      description: >-
        Personal API token created under Settings → API tokens. Only routes
        guarded by verifyApiAuth accept it, and the token must carry the scope
        named in the operation's x-required-scope.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.