Populate custom fields when creating an order through the Store API

Question

We're using the store-api/checkout/order endpoint to create an order in Shopware. All working fine, but we also want to populate some customFields from the order. It seems the body can only contain:

{
  "customerComment": "string",
  "affiliateCode": "string",
  "campaignCode": "string"
}

Is there another way to populate the order customFields besides overriding the CartOrderRoute?

Answer 1

I'm not aware of a way to do it through the store-api, which is a bummer. At least the RequestDataBag could be passed to the CheckoutOrderPlacedEvent so one has a simpler extension point.

I'm certain this currently is not allowed because of security, because this is a public api and anyone could inject any value into the custom fields if it were allowed.

So if you end up overriding the CartOrderRoute make sure to have some kind of allow-list and validation for your custom-fields and their values. Otherwise anyone can inject anything into the custom-field of the order.