Released contract

Server-authoritative commerce backorders

CentriPOS resolves backorder eligibility on the server. A storefront must never infer that an unavailable item can be sold. Physical availability and policy-approved purchasability are deliberately separate.

Release boundary. Backorder policy, catalog projections, quote reservation, order-line snapshots, Retail API fields, and signed event production are implemented. Checkout, fulfillment, and payment remain independently capability-gated for each tenant.

Policy precedence

Level	Purpose	Modes
Variant	Override one exact sellable option.	Inherit, deny, allow and notify, allow
Product	Set a product-wide default.	Inherit, deny, allow and notify, allow
Tenant	Provide the store-wide fallback.	Deny, allow and notify, allow

The effective policy can include a maximum shortage per line, ETA in days, and a bounded customer message. Deny is the fail-closed default.

Reservation and allocation

The quote locks the exact location-and-variant inventory row.
Available physical stock is reserved first after POS reservations and active commerce holds.
Only a policy-approved shortage becomes a backorder commitment.
The sale line stores the accepted state, reserved quantity, backorder quantity, policy, ETA date, and customer message as an immutable snapshot.
Later allocation locks both the commitment and stock, decrements physical stock atomically, and advances the commitment status.

Synthetic API shape

{
  "inventory_commitment": {
    "state": "backordered",
    "reserved_quantity": 0,
    "backorder_quantity": 1,
    "policy": "allow_notify",
    "eta_date": "2026-09-03",
    "customer_message": "Available on backorder. Estimated fulfillment in 10 days."
  },
  "backorder": {
    "status": "awaiting_stock",
    "allocated_quantity": 0,
    "remaining_quantity": 1
  }
}

Signed webhook events

commerce_backorder.created and commerce_backorder.updated are identity-only notifications. The payload identifies the event and sale resource; it does not contain raw database rows, customer records, pricing internals, credentials, or inventory routing. Verify the HMAC signature and timestamp, reject stale deliveries, deduplicate the immutable event ID, then retrieve the current supported sale with a separately scoped key.

Contract doctrine

Private POS domains will be listed only as controlled-rollout contracts until tenant-scoped keys, scopes, sandbox isolation, audit logs, idempotency, and webhooks are enforced end to end.

Read the complete synthetic schemas and operation status in the Retail API OpenAPI contract.