API Calls

Base URL

All MallPlus Open Platform API requests use the following base URLs:

All endpoints are prefixed with /open/v1. For example, the full URL for listing products in production is https://sandbox.open.mallplus.ph/open/v1/products.

Request Format

All API requests must be made over HTTPS. HTTP requests will be rejected. Request bodies (for POST and PUT) must be JSON-encoded with the Content-Type: application/json header.

Every request must include the three authentication headers described in the Authentication guide.

Response Format

All responses are JSON-encoded. Successful responses return a top-level success: true field with data in the data field. Error responses include an error object with a machine-readable code and a human-readable message.

// Success
{ "success": true, "data": { ... } }

// Error
{
  "success": false,
  "error": {
    "code": "INVALID_SIGNATURE",
    "message": "The request signature is invalid"
  }
}

Rate Limits

API calls are rate-limited per app at a default of 600 requests per minute, shared across all endpoints and methods — reads and writes draw from the same budget. Unauthenticated endpoints are limited per source IP instead.

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers. When you exceed the limit, the API returns 429 RATE_LIMITED with a Retry-After header indicating how many seconds to wait before retrying.

See the Rate Limits guide for the full policy, response headers, the real-time usage meter, and backoff guidance.

Endpoint Reference

All endpoints require HMAC-SHA256 authentication. See the Authentication guide for signing details. Click the API name link for full documentation with request/response examples.

9 scopes:catalog:read, catalog:write, orders:read, orders:write, inventory:read, inventory:write, fulfillment:read, fulfillment:write, seller:read