API reference / Auth

List the seller authorizations granted to the calling app (seller_id, scopes, granted_at, expires_at). Defaults to status=active; pass status=all|revoked|expired for the full history. This is the partner-facing source of the seller_id values used by seller-token calls and POST /auth/revoke.

GET/open/v1/authorizationsScope: No data scope

Service Endpoint Seller token not required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/authorizations`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/authorizations`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Conditional	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Conditional	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

Name	In	Type	Required	Rules	Description
page	query	integer	No	Minimum: 1; Default: 1	1-based page number to return.
limit	query	integer	No	Minimum: 1; Maximum: 100; Default: 20	Maximum number of records to return.
status	query	enum	No	Allowed: active, revoked, expired, all; Default: active	Resource status to include in the list.

Request Body

This operation has no JSON request body.

Response Parameters

Success status: HTTP 200

Field	Type	Rules	Description
success	enum	Allowed: true	Whether the request completed successfully.
data	array<object>	-	Response or event payload for this schema.
data[]	object	-	-
data[].seller_id	string	-	Seller identifier — the value used by seller-token calls and POST /auth/revoke.
data[].seller_name	string	Nullable	Display name of the seller.
data[].scopes	array<string>	-	OAuth scopes requested or granted.
data[].scopes[]	string	-	-
data[].status	enum	Allowed: active, revoked, expired	Effective grant status. A stored grant past its 365-day expiry is reported as expired even before the lazy storage flip.
data[].granted_at	string<date-time>	Format: date-time	Granted at as an ISO-8601 timestamp.
data[].expires_at	string<date-time>	Format: date-time	End of the 365-day authorization window; the seller must re-consent after this. ISO-8601 timestamp.
meta	PaginationMeta	-	Response metadata, including pagination when the endpoint returns a list.
meta.page	integer	-	1-based page number represented by this response page. Offset paging only — omitted during a cursor walk.
meta.limit	integer	-	Maximum number of records returned in this response page.
meta.total	integer	-	Total number of records matching the request filters. Offset paging only — omitted during a cursor walk, where no total is computed.
meta.nextCursor	string	-	Opaque cursor for the next page of a keyset walk. Present only while walking by cursor and only while more rows may remain; its absence ends the walk. Pass it back unchanged as `cursor`.

Error Codes

HTTP Status	Schema	Description
400	PlatformError400Response	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	PlatformError401Response	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	PlatformError403Response	Forbidden — insufficient scope
429	PlatformError429Response	The partner or endpoint rate limit has been exceeded
503	PlatformError503Response	A required platform or upstream dependency is temporarily unavailable

This operation does not declare its own error.code list. Any operation can return the authentication, signing, scope, rate-limit and system codes listed in the Error code reference.

Request Example

# Sandbox: https://sandbox.open.mallplus.ph/open/v1/authorizations
curl -X GET "https://open.mallplus.ph/open/v1/authorizations" \
  -H "X-MallPlus-Partner-Id: mp_partner_123" \
  -H "X-MallPlus-Timestamp: 1786924800" \
  -H "X-MallPlus-Signature-Version: 3" \
  -H "X-MallPlus-Nonce: 4f8b9a0c4d5e6f708192a3b4c5d6e7f8" \
  -H "X-MallPlus-Signature: <hex_hmac_sha256>"

Response Example

{
  "success": true,
  "data": [
    {
      "seller_id": "seller_id_123",
      "seller_name": "example_seller_name",
      "scopes": [
        "example_scopes"
      ],
      "status": "active",
      "granted_at": "2026-08-17T00:00:00Z",
      "expires_at": "2026-08-17T00:00:00Z"
    }
  ],
  "meta": {
    "page": 1,
    "limit": 20,
    "total": 150,
    "nextCursor": "eyJ0cyI6IjIwMjYtMDgtMTVUMDk6MzA6MDAuMDAwWiIsImlkIjoicGNhdF8xIn0"
  }
}