Nearly correct. POST does not specify the name of the resource. So you do
/orders/42 # with { order: { paid: true } }