# Choose a shipping option

URL: /docs/api/storefront/cart/choose-a-shipping-option

## PUT /v1/cart/shipping-option

```http
PUT https://api.elaraone.app/api/v1/cart/shipping-option
```

### Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `X-Cart-Token` | header | string | yes | The cart token from POST /api/v1/cart. |
| `X-Client-IP` | header | string |  | Optional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions. |
| `X-Tenant-Secret` | header | string |  | Optional here. Server secret of the store: server-to-server only, never from a browser. Enables X-Client-IP. |
| `X-Session-Id` | header | string |  | Optional. The shopper's `sid` cookie value (8-128 of letters, digits, `.` `_` `:` `-`). Recorded on the basket as a SHA-256 hash only (never the raw value), so the order can be checked against the consent in force when it is placed, even when Stripe or PayPal settle it later without a request. Send it on every basket write; an absent header keeps the stored hash, and a malformed one is ignored. |
| `X-Visitor-Id` | header | string |  | Optional. The `vid` cookie value, when the shopper has one. Recorded on the basket as a SHA-256 hash only (never the raw value), so the order can be checked against the consent in force when it is placed, even when Stripe or PayPal settle it later without a request. Send it on every basket write; an absent header keeps the stored hash, and a malformed one is ignored. |
| `X-Consent-Token` | header | string |  | Optional. The `consent` cookie value (the `consent_token` from `PUT consent`). Recorded on the basket as a SHA-256 hash only (never the raw value), so the order can be checked against the consent in force when it is placed, even when Stripe or PayPal settle it later without a request. Send it on every basket write; an absent header keeps the stored hash, and a malformed one is ignored. |
| `X-GA-Client-Id` | header | string |  | Optional. The GA4 client id from the `_ga` cookie that the Google tag of the merchant set: its last two numbers (`GA1.1.1234567890.1699999999` → `1234567890.1699999999`, `^\d{1,10}\.\d{1,10}$`). Send it only when the shopper has granted analytics AND advertising. Kept with the basket and the order only while both are in force (removed when either is withdrawn, on erasure, and after its window), and sent to Google Analytics as the `client_id` of the purchase, so GA4 joins it to the visit. An absent header keeps the stored id; a malformed one is ignored (never a 422). |

### Request body (`application/json`)

| Field | Type | Required | Description |
|---|---|---|---|
| `identifier` | string | yes |  |

### Responses

- **200**: Success.
- **402**: Payment required. Branch on `error.code`: - `TENANT_PAYMENT_REQUIRED`: this store is on payment hold. Show a "store temporarily unavailable" page; do not retry the request.
- **404**: Not found: `FEATURE_NOT_ENABLED` when this store does not have the Shop feature on.
- **422**: Validation error