# GET /v2/booking/{id}/invoice_address_suggestions

Frühere Rechnungsadressen vorschlagen

Ermittelt höchstens vier unterschiedliche aktive Rechnungsadressen aus früheren Buchungen des Buchungsinhabers. Die aktuelle Buchung wird ausgeschlossen. Jeder Vorschlag enthält data0 bis data8, active und b2b, einen abgeleiteten 16-stelligen id-Fingerprint sowie bookings mit öffentlichen Buchungs-IDs und Buchungsnummern der zugehörigen früheren Buchungen.

- Operation-ID: get_v2_booking_id_invoice_address_suggestions
- Dokumentation: /docs/api/v2/operations/get-v2-booking-id-invoice-address-suggestions-014c1eb79efc/
- OpenAPI-Version: 3.2.1
- Vollständige Spezifikation: /docs/api/v2/openapi.json
- Dokumentationsstatus: reviewed
- Ändert Zustand: nein, gemäss Annotation
- Für Automation freigegeben: ja, siehe Voraussetzungen

## Server

Serverwerte stammen unverändert aus der Datei. Eine lokale Entwicklungsadresse ist keine bestätigte Produktionsadresse. `API_ORIGIN` muss auf die passende Instanz gesetzt werden.

```json
[
  {
    "url": "https://app2.edoobox.com",
    "description": "edoobox API"
  }
]
```

## Authentifizierung

Eine der folgenden Alternativen genügt (ODER). Innerhalb einer Alternative müssen alle Verfahren gemeinsam erfüllt sein (UND).

1. **bearerAuth** (HTTP bearer) — Existing edoobox v2 access token. Never substitute API key/secret headers. **UND** **accountContext** (header: edid) — Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account.
2. **sessionCookie** (cookie: _edlogin) — Existing browser login session, with the same permission checks as Bearer authentication. **UND** **accountContext** (header: edid) — Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account.

### Wirksame Security Requirements und vollständige Verfahren

```json
{
  "security": [
    {
      "bearerAuth": [],
      "accountContext": []
    },
    {
      "sessionCookie": [],
      "accountContext": []
    }
  ],
  "securitySchemes": {
    "bearerAuth": {
      "type": "http",
      "scheme": "bearer",
      "bearerFormat": "JWT",
      "description": "Existing edoobox v2 access token. Never substitute API key/secret headers."
    },
    "accountContext": {
      "type": "apiKey",
      "in": "header",
      "name": "edid",
      "description": "Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account."
    },
    "sessionCookie": {
      "type": "apiKey",
      "in": "cookie",
      "name": "_edlogin",
      "description": "Existing browser login session, with the same permission checks as Bearer authentication."
    }
  }
}
```

## Parameter

| Name | Ort | Pflicht | Beschreibung |
| --- | --- | --- | --- |
| id | path | ja | v2 object identifier in the selected account. |
| language | header | nein | Account language code, where the resource supports setLanguage(). |

### Vollständige wirksame Parameterdefinitionen

```json
[
  {
    "name": "id",
    "in": "path",
    "required": true,
    "description": "v2 object identifier in the selected account.",
    "schema": {
      "type": "string",
      "pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
      "description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
      "examples": [
        "booking_012345abcdef_123456"
      ]
    }
  },
  {
    "name": "language",
    "in": "header",
    "required": false,
    "description": "Account language code, where the resource supports setLanguage().",
    "schema": {
      "type": "string",
      "examples": [
        "de"
      ]
    }
  }
]
```

## Anfrage

Kein Request Body deklariert.

## Antworten

HTTP-Status und Antwortinhalt gemeinsam auswerten. Die folgenden Beschreibungen und Schemata sind die Angaben der Quelldatei.

```json
{
  "200": {
    "description": "Erweiterte fachliche Rückgabe in data; die aufgeführten Sammlungen können leer sein und enthalten ausschliesslich öffentliche Referenzen.",
    "content": {
      "application/json": {
        "example": {
          "success": true,
          "error": false,
          "data": {
            "suggestions": [
              {
                "active": true,
                "b2b": false,
                "data0": "",
                "data1": "Beispiel AG",
                "data2": "Alex Beispiel",
                "data3": "Musterstrasse 1",
                "data4": "8000 Zürich",
                "data5": "rechnung@example.invalid",
                "data6": "country_012345abcdef_123456",
                "data7": "",
                "data8": "",
                "id": "012345abcdef6789",
                "bookings": [
                  {
                    "id": "booking_012345abcdef_123457",
                    "number": "2026-0999"
                  }
                ]
              }
            ]
          }
        },
        "schema": {
          "type": "object",
          "properties": {
            "success": {
              "type": "boolean"
            },
            "error": {
              "type": [
                "boolean",
                "string"
              ]
            },
            "error_code": {
              "type": "string"
            },
            "data": {
              "type": "object",
              "properties": {
                "suggestions": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "data0": {
                        "type": "string"
                      },
                      "data1": {
                        "type": "string"
                      },
                      "data2": {
                        "type": "string"
                      },
                      "data3": {
                        "type": "string"
                      },
                      "data4": {
                        "type": "string"
                      },
                      "data5": {
                        "type": "string"
                      },
                      "data6": {
                        "anyOf": [
                          {
                            "type": "string",
                            "pattern": "^country_[a-f0-9]{12}_-?[0-9]+$",
                            "examples": [
                              "country_012345abcdef_123456"
                            ]
                          },
                          {
                            "const": false
                          }
                        ]
                      },
                      "data7": {
                        "type": "string"
                      },
                      "data8": {
                        "type": "string"
                      },
                      "active": {
                        "type": "boolean"
                      },
                      "b2b": {
                        "type": "boolean"
                      },
                      "id": {
                        "type": "string",
                        "pattern": "^[a-f0-9]{16}$",
                        "description": "Abgeleiteter Adress-Fingerprint, keine Datenbank-ID."
                      },
                      "bookings": {
                        "type": "array",
                        "items": {
                          "type": "object",
                          "properties": {
                            "id": {
                              "type": "string",
                              "pattern": "^booking_[a-f0-9]{12}_-?[0-9]+$",
                              "examples": [
                                "booking_012345abcdef_123456"
                              ]
                            },
                            "number": {
                              "type": "string"
                            }
                          },
                          "additionalProperties": true
                        }
                      }
                    },
                    "additionalProperties": true
                  },
                  "maxItems": 4
                }
              },
              "additionalProperties": true
            },
            "type": {
              "type": "string"
            }
          },
          "additionalProperties": true
        }
      }
    }
  },
  "400": {
    "description": "Invalid request.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED40006"
        }
      }
    }
  },
  "401": {
    "description": "Missing/expired token, missing account context, account paused or model-specific authorization failure.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED40103"
        }
      }
    }
  },
  "402": {
    "description": "Missing/invalid action data or subscription/operation restriction.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED80100"
        }
      }
    }
  },
  "403": {
    "description": "Permission denied. Browser CORS rejection may have an empty body.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED40340"
        }
      }
    }
  },
  "404": {
    "description": "Unknown resource/action or unsupported method.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED80019"
        }
      }
    }
  },
  "422": {
    "description": "Validation failed.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED80020"
        }
      }
    }
  },
  "429": {
    "description": "Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED42902"
        }
      }
    },
    "headers": {
      "Retry-After": {
        "description": "Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.",
        "schema": {
          "type": "string",
          "examples": [
            "30"
          ]
        }
      }
    }
  },
  "502": {
    "description": "Server-side operation failed.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED50201"
        }
      }
    }
  }
}
```

## Aufrufbeispiele

Anpassen vor dem Ausführen. Platzhalter und veröffentlichte Beispiele sind synthetisch. Die Beispiele senden hier keine Anfrage; sie ergänzen keine unbekannten Pflichtfelder.

### cURL

```sh
# Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
# cURL: PATH_* bereits URL-kodiert setzen. JavaScript/Python kodieren die unveränderten Pfadwerte selbst.
: "${API_ORIGIN:?API_ORIGIN setzen}"
: "${AUTH_BEARERAUTH:?AUTH_BEARERAUTH setzen}"
: "${AUTH_ACCOUNTCONTEXT:?AUTH_ACCOUNTCONTEXT setzen}"
: "${PATH_ID:?PATH_ID setzen}"
curl --request 'GET' \
  --url "${API_ORIGIN%/}"'/v2/booking/'"${PATH_ID}"'/invoice_address_suggestions' \
  --header 'Authorization: Bearer '"${AUTH_BEARERAUTH}" \
  --header 'edid: '"${AUTH_ACCOUNTCONTEXT}"
```

### JavaScript (Node.js)

```javascript
// Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
const required = (name) => {
  const value = process.env[name];
  if (!value) throw new Error(`Set ${name}`);
  return value;
};
let path = "/v2/booking/{id}/invoice_address_suggestions";
path = path.replaceAll("{id}", encodeURIComponent(required("PATH_ID")));
const origin = required('API_ORIGIN');
const url = new URL((origin.endsWith('/') ? origin.slice(0, -1) : origin) + path);
const headers = {};
headers["Authorization"] = "Bearer " + required("AUTH_BEARERAUTH");
headers["edid"] = "" + required("AUTH_ACCOUNTCONTEXT");
const response = await fetch(url, { method: "GET", headers, redirect: 'manual' });
const text = await response.text();
console.log(response.status, text);
// HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen.
```

### Python

```python
# Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
import os
import urllib.parse
import urllib.request
import urllib.error

path = "/v2/booking/{id}/invoice_address_suggestions"
path = path.replace("{id}", urllib.parse.quote(os.environ["PATH_ID"], safe=""))
url = os.environ["API_ORIGIN"].rstrip("/") + path
headers = {}
headers["Authorization"] = "Bearer " + os.environ["AUTH_BEARERAUTH"]
headers["edid"] = "" + os.environ["AUTH_ACCOUNTCONTEXT"]

# Redirects nicht automatisch verfolgen.
class NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None
request = urllib.request.Request(url, headers=headers, method="GET")
try:
    response = urllib.request.build_opener(NoRedirect).open(request, timeout=30)
except urllib.error.HTTPError as error:
    response = error
print(response.status, response.read().decode("utf-8", errors="replace"))
# HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen.
```

## Vollständige Operationsdefinition und edoobox-Hinweise

Alle Originalfelder einschliesslich `x-edoobox-*`, requestBody und responses bleiben erhalten. Teilweise dokumentierte Schemata sind kein vollständiger Validierungsvertrag.

```json
{
  "operationId": "get_v2_booking_id_invoice_address_suggestions",
  "summary": "Frühere Rechnungsadressen vorschlagen",
  "description": "Ermittelt höchstens vier unterschiedliche aktive Rechnungsadressen aus früheren Buchungen des Buchungsinhabers. Die aktuelle Buchung wird ausgeschlossen. Jeder Vorschlag enthält data0 bis data8, active und b2b, einen abgeleiteten 16-stelligen id-Fingerprint sowie bookings mit öffentlichen Buchungs-IDs und Buchungsnummern der zugehörigen früheren Buchungen.",
  "tags": [
    "booking"
  ],
  "security": [
    {
      "bearerAuth": [],
      "accountContext": []
    },
    {
      "sessionCookie": [],
      "accountContext": []
    }
  ],
  "parameters": [
    {
      "name": "id",
      "in": "path",
      "required": true,
      "description": "v2 object identifier in the selected account.",
      "schema": {
        "type": "string",
        "pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
        "description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
        "examples": [
          "booking_012345abcdef_123456"
        ]
      }
    },
    {
      "name": "language",
      "in": "header",
      "required": false,
      "description": "Account language code, where the resource supports setLanguage().",
      "schema": {
        "type": "string",
        "examples": [
          "de"
        ]
      }
    }
  ],
  "responses": {
    "200": {
      "description": "Erweiterte fachliche Rückgabe in data; die aufgeführten Sammlungen können leer sein und enthalten ausschliesslich öffentliche Referenzen.",
      "content": {
        "application/json": {
          "example": {
            "success": true,
            "error": false,
            "data": {
              "suggestions": [
                {
                  "active": true,
                  "b2b": false,
                  "data0": "",
                  "data1": "Beispiel AG",
                  "data2": "Alex Beispiel",
                  "data3": "Musterstrasse 1",
                  "data4": "8000 Zürich",
                  "data5": "rechnung@example.invalid",
                  "data6": "country_012345abcdef_123456",
                  "data7": "",
                  "data8": "",
                  "id": "012345abcdef6789",
                  "bookings": [
                    {
                      "id": "booking_012345abcdef_123457",
                      "number": "2026-0999"
                    }
                  ]
                }
              ]
            }
          },
          "schema": {
            "type": "object",
            "properties": {
              "success": {
                "type": "boolean"
              },
              "error": {
                "type": [
                  "boolean",
                  "string"
                ]
              },
              "error_code": {
                "type": "string"
              },
              "data": {
                "type": "object",
                "properties": {
                  "suggestions": {
                    "type": "array",
                    "items": {
                      "type": "object",
                      "properties": {
                        "data0": {
                          "type": "string"
                        },
                        "data1": {
                          "type": "string"
                        },
                        "data2": {
                          "type": "string"
                        },
                        "data3": {
                          "type": "string"
                        },
                        "data4": {
                          "type": "string"
                        },
                        "data5": {
                          "type": "string"
                        },
                        "data6": {
                          "anyOf": [
                            {
                              "type": "string",
                              "pattern": "^country_[a-f0-9]{12}_-?[0-9]+$",
                              "examples": [
                                "country_012345abcdef_123456"
                              ]
                            },
                            {
                              "const": false
                            }
                          ]
                        },
                        "data7": {
                          "type": "string"
                        },
                        "data8": {
                          "type": "string"
                        },
                        "active": {
                          "type": "boolean"
                        },
                        "b2b": {
                          "type": "boolean"
                        },
                        "id": {
                          "type": "string",
                          "pattern": "^[a-f0-9]{16}$",
                          "description": "Abgeleiteter Adress-Fingerprint, keine Datenbank-ID."
                        },
                        "bookings": {
                          "type": "array",
                          "items": {
                            "type": "object",
                            "properties": {
                              "id": {
                                "type": "string",
                                "pattern": "^booking_[a-f0-9]{12}_-?[0-9]+$",
                                "examples": [
                                  "booking_012345abcdef_123456"
                                ]
                              },
                              "number": {
                                "type": "string"
                              }
                            },
                            "additionalProperties": true
                          }
                        }
                      },
                      "additionalProperties": true
                    },
                    "maxItems": 4
                  }
                },
                "additionalProperties": true
              },
              "type": {
                "type": "string"
              }
            },
            "additionalProperties": true
          }
        }
      }
    },
    "400": {
      "description": "Invalid request.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40006"
          }
        }
      }
    },
    "401": {
      "description": "Missing/expired token, missing account context, account paused or model-specific authorization failure.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40103"
          }
        }
      }
    },
    "402": {
      "description": "Missing/invalid action data or subscription/operation restriction.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80100"
          }
        }
      }
    },
    "403": {
      "description": "Permission denied. Browser CORS rejection may have an empty body.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40340"
          }
        }
      }
    },
    "404": {
      "description": "Unknown resource/action or unsupported method.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80019"
          }
        }
      }
    },
    "422": {
      "description": "Validation failed.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80020"
          }
        }
      }
    },
    "429": {
      "description": "Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED42902"
          }
        }
      },
      "headers": {
        "Retry-After": {
          "description": "Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.",
          "schema": {
            "type": "string",
            "examples": [
              "30"
            ]
          }
        }
      }
    },
    "502": {
      "description": "Server-side operation failed.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED50201"
          }
        }
      }
    }
  },
  "x-edoobox-mutates-state": false,
  "x-edoobox-get-effect": "read",
  "x-edoobox-get-permission-review": {
    "file": "docs/openapi/reviews/vue-get-permission-01.json",
    "pointer": "/operations/12",
    "sha256": "98bf744c7b83fe3aef56618efbe2f3f1c34a5a4790833fa03324cf7ba696c55d",
    "scope": "Resource-handler effect. Shared account lifecycle maintenance, read caches and technical revision fences remain separately authorized."
  },
  "x-edoobox-mutationReview": {
    "source": {
      "file": "application/models/v2/Booking.php",
      "line": 790,
      "lineEnd": 865,
      "sha256": "78bb2e6d2875243f1267a8724ab29e406b7c93dd351c50f6a270f9c184ae81b5",
      "reason": "Decodes current booking, queries account-scoped account/booking owner and delegates to invoice address suggestions."
    },
    "reason": "Suggests invoice addresses already recorded for the booking owner/account.",
    "review": {
      "file": "docs/openapi/reviews/vue-get-permission-01.json",
      "pointer": "/operations/12",
      "sha256": "98bf744c7b83fe3aef56618efbe2f3f1c34a5a4790833fa03324cf7ba696c55d",
      "scope": "Resource-handler effect. Shared account lifecycle maintenance, read caches and technical revision fences remain separately authorized."
    }
  },
  "x-edoobox-runtimeMutationGuard": false,
  "x-edoobox-documentationReview": {
    "file": "docs/openapi/operation-contracts/02-booking-users.json",
    "notes": []
  },
  "x-edoobox-source": {
    "file": "application/models/v2/Booking.php",
    "method": "getBooking",
    "line": 556,
    "branch": {
      "file": "application/models/v2/Booking.php",
      "line": 790
    }
  },
  "x-edoobox-documentationStatus": "reviewed",
  "x-edoobox-readOnly": true,
  "x-edoobox-safeForAutomation": true,
  "x-edoobox-permission": {
    "resource": "booking",
    "short": "book",
    "checkedByDispatcher": true,
    "levels": [
      1,
      3,
      4
    ],
    "description": "Resource permission mapping from APIPermissions(), Authfunc::_getCheckJWT. Additional model/admin/plugin checks may apply; resources absent from api_permission do not acquire a fictitious scope."
  }
}
```