diff --git a/src/api/unifiedHttp.test.mjs b/src/api/unifiedHttp.test.mjs
index 63e5da8..ecc5ba3 100644
--- a/src/api/unifiedHttp.test.mjs
+++ b/src/api/unifiedHttp.test.mjs
@@ -59,6 +59,13 @@ test('order and lastleg 401s share one refresh and replay the unified access tok
   assert.equal(calls.filter((call) => call.token === 'Bearer new-access').length, 2)
 })
 
+test('successful order submit with explicit null data is accepted', async () => {
+  const http = harness(async (config) => ({
+    config, status: 200, headers: {}, data: { code: '200', message: 'success', data: null },
+  }))
+  assert.equal(await http.apiRequest({ method: 'POST', url: '/merchant/v1/orders/first-leg/order-1/submit' }), null)
+})
+
 test('data-less security failures preserve diagnostics and malformed success is rejected', async () => {
   for (const data of [{ code: 'A0403', message: 'Denied', traceId: 'trace-1', requestId: 'request-1' }, { code: '200', message: 'OK' }]) {
     const http = harness(async (config) => ({ config, status: 200, headers: {}, data }))