API reference / Products

List products with pagination

Product listing is available with limited support for deep cursor traversal.

GET/open/v1/productsScope: catalog:read

Service Endpoint Seller token required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/products`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/products`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Yes	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Yes	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

Name	In	Type	Required	Rules	Description
page	query	integer	No	Minimum: 1	1-based page number to return.
limit	query	integer	No	Minimum: 1; Maximum: 100	Maximum number of records to return.
page_size	query	integer	No	Minimum: 1; Maximum: 100	Requested page size. When omitted, the endpoint uses the standard limit value.
q	query	string	No	-	Search text used to filter products by partner-visible product fields.
status	query	enum	No	Allowed: live, unlisted, delisted, proposed, under_review, archived, published, draft	Product status to include in the list. Accepts every status a product can be observed in — settable by the partner: live, unlisted, delisted; read-only, set by the platform: proposed, under_review, archived. Deprecated aliases accepted for compatibility: published (= live), draft (= unlisted).
category	query	string	No	-	Product category ID or category slug used to filter products.
sort	query	enum	No	Allowed: created_at_asc, created_at_desc, price_asc, price_desc	Product sort order. Supported values sort by creation time or price.
cursor	query	string	No	-	Pagination cursor returned by a previous response page.

Request Body

This operation has no JSON request body.

Response Parameters

Field	Type	Rules	Description
success	boolean	-	Whether the request completed successfully.
data	array<Product>	-	Response or event payload for this schema.
data[]	Product	No additional properties	Partner-safe product view. Supplier-internal fields are stripped at the API boundary.
data[].product_id	string	-	Product ID associated with this value.
data[].short_id	string	-	Human-friendly alternate product identifier
data[].name	string	-	Partner-visible name.
data[].description	string	-	Human-readable description.
data[].status	enum	Allowed: live, unlisted, delisted, proposed, under_review, archived	Current product status. This is the complete set — settable by the partner via POST /open/v1/products/{id}/status: live, unlisted, delisted; read-only, set by the platform: proposed, under_review, archived (proposed after create, under_review while in review, archived after delete). Every value here is also accepted by GET /open/v1/products?status=.
data[].sku	string	-	SKU of the primary variant
data[].price	integer	-	Integer amount in PHP centavos.
data[].stock	integer	-	Stock of the primary variant
data[].category	string	-	Product category.
data[].thumbnail	string	-	Product thumbnail image URL.
data[].images	array<string>	-	Product image URLs, in display order.
data[].images[]	string	-	Publicly reachable https image URL.
data[].weight	number	-	Weight in grams
data[].dimensions	object	No additional properties	Package dimensions in centimetres.
data[].dimensions.length	number	-	Package length in centimetres.
data[].dimensions.width	number	-	Package width in centimetres.
data[].dimensions.height	number	-	Package height in centimetres.
data[].variants	array<ProductVariant>	-	Product variants.
data[].variants[]	ProductVariant	No additional properties	A single purchasable variant of a product.
data[].variants[].variant_id	string	-	Product variant ID associated with this value.
data[].variants[].sku	string	Nullable	Seller SKU.
data[].variants[].price	integer	Nullable	Integer amount in PHP centavos.
data[].variants[].stock_quantity	integer	Nullable	Available stock on hand at the default location
data[].variants[].options	array<object>	-	Variant option values (e.g. Size=M, Color=Black).
data[].variants[].options[]	object	No additional properties	One option of the variant, as a name/value pair.
data[].variants[].options[].name	string	Nullable	Option name, for example Size.
data[].variants[].options[].value	string	Nullable	Option value, for example M.
data[].variants[].dimensions	object	No additional properties	Package dimensions in centimetres.
data[].variants[].dimensions.length	number	-	Package length in centimetres.
data[].variants[].dimensions.width	number	-	Package width in centimetres.
data[].variants[].dimensions.height	number	-	Package height in centimetres.
data[].variants[].weight	number	-	Weight in grams
data[].variants[].images	array<string>	-	Variant image URLs, in display order.
data[].variants[].images[]	string	-	Publicly reachable https image URL.
data[].options_order	array<object>	-	Variant option groups in display order, each with its values in order — the order a storefront renders the variant picker in. Derived at create time from the order the options were submitted in; absent on products with no option groups.
data[].options_order[]	object	No additional properties	-
data[].options_order[].title	string	-	Option group name, e.g. `Colour`.
data[].options_order[].values	array<string>	-	The group's values, in display order.
data[].options_order[].values[]	string	-	-
data[].created_at	string<date-time>	Format: date-time	Created at as an ISO-8601 timestamp.
data[].updated_at	string<date-time>	Format: date-time	Updated at as an ISO-8601 timestamp.
meta	PaginationMeta	-	Response metadata, including pagination when the endpoint returns a list.
meta.page	integer	-	1-based page number represented by this response page.
meta.limit	integer	-	Maximum number of records returned in this response page.
meta.total	integer	-	Total number of records matching the request filters.

Error Codes

HTTP Status	Schema	Description
400	ErrorResponse	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	ErrorResponse	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	ErrorResponse	Forbidden — insufficient scope
429	ErrorResponse	The partner or endpoint rate limit has been exceeded
502	ErrorResponse	The upstream commerce service rejected the request or returned an invalid response
503	ErrorResponse	A required platform or upstream dependency is temporarily unavailable
504	ErrorResponse	The upstream commerce service did not respond before the platform timeout

Machine-readable codes are returned in error.code: ACCOUNT_LOCKED, APPROVE_FAILED, APP_LIMIT_REACHED, APP_NOT_FOUND, AUTHORIZATION_CODE_EXPIRED, AUTHORIZATION_REVOKED, AUTH_CODE_EXPIRED, AUTH_CODE_USED, BAD_REQUEST, CANCELLATION_ALREADY_PROCESSED, CANCELLATION_DEADLINE_EXCEEDED, CANCEL_FAILED, CANNOT_DELETE_ACCOUNT_WITH_APPS, CONCURRENT_MODIFICATION, CONFLICT, CREATE_FAILED, DISPUTE_FAILED, DUPLICATE, EMAIL_ALREADY_EXISTS, EMAIL_NOT_VERIFIED, FILE_TOO_LARGE, FORBIDDEN, HMAC_VERSION_DEPRECATED, IDEMPOTENCY_KEY_IN_PROGRESS, IDEMPOTENCY_KEY_REQUIRED, IDEMPOTENCY_KEY_REUSED, INTERNAL_ERROR, INVALID_AUTHORIZATION_CODE, INVALID_CREDENTIALS, INVALID_DEVELOPER_TYPE, INVALID_FILE_CONTENT, INVALID_FILE_TYPE, INVALID_JSON, INVALID_NONCE, INVALID_PATH, INVALID_PICKUP_DATE, INVALID_REFRESH_TOKEN, INVALID_REQUEST, INVALID_SIGNATURE, INVALID_STATE, INVALID_TRANSITION, INVALID_VERIFICATION_TOKEN, MAINTENANCE, MEMBER_PERMISSION_DENIED, MISSING_NONCE, NONCE_REUSED, NOT_FOUND, NOT_IMPLEMENTED, ORDER_NOT_CANCELLABLE, PAYLOAD_TOO_LARGE, PICKUP_DATES_UNAVAILABLE, PRODUCT_HAS_ACTIVE_ORDERS, PRODUCT_UNDER_REVIEW, PROFILE_ALREADY_SUBMITTED, PROFILE_TYPE_MISMATCH, PROXY_ERROR, RATE_LIMITED, REDIRECT_URL_MISMATCH, REFRESH_TOKEN_EXPIRED, REFRESH_TOKEN_REUSED, REJECT_FAILED, RETURN_ALREADY_PROCESSED, RETURN_DEADLINE_EXCEEDED, RE_AUTHORIZATION_REQUIRED, SANDBOX_LIMIT_REACHED, SELLER_TOKEN_REQUIRED, SERVICE_UNAVAILABLE, SESSION_EXPIRED, SHIPMENT_ALREADY_ARRANGED, SHIPMENT_NOT_ARRANGED, SHIPPING_LABEL_UNAVAILABLE, SHIP_FAILED, SIGNATURE_REPLAYED, SSRF_CHECK_FAILED, TEST_SHOP_LIMIT_REACHED, TIMESTAMP_EXPIRED, TOKEN_REVOKED, TOO_MANY_REQUESTS, UNAUTHORIZED, UPLOAD_ERROR, UPLOAD_NOT_CONFIGURED, UPSTREAM_ERROR, UPSTREAM_TIMEOUT, VALIDATION_ERROR, VERIFICATION_LINK_USED, VERIFICATION_TOKEN_EXPIRED, WEBHOOK_SUBSCRIPTION_EXISTS

Examples

Executable examples are hidden for this endpoint until copy-paste guidance is published.