API reference / Orders

List orders with pagination

Order listing is available with limited filtering and sorting support.

GET/open/v1/ordersScope: orders:read

Service Endpoint Seller token required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/orders`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/orders`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Yes	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Yes	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

Name	In	Type	Required	Rules	Description
page	query	integer	No	Minimum: 1	1-based page number to return.
limit	query	integer	No	Minimum: 1; Maximum: 100	Maximum number of records to return.
status	query	enum	No	Allowed: READY_TO_SHIP, SHIPPED, DELIVERED, CANCELLED, RETURN_REFUND	Order status to include in the list.
created_after	query	string<date-time>	No	Format: date-time	Return records created at or after this ISO-8601 timestamp.
created_before	query	string<date-time>	No	Format: date-time	Return records created before this ISO-8601 timestamp.
sort	query	enum	No	Allowed: created_at_asc, created_at_desc	Order sort order. Supported values sort by creation time.
cursor	query	string	No	-	Pagination cursor returned by a previous response page.

Request Body

This operation has no JSON request body.

Response Parameters

Field	Type	Rules	Description
success	boolean	-	Whether the request completed successfully.
data	array<Order>	-	Response or event payload for this schema.
data[]	Order	No additional properties	Partner-safe order view. Internal status fields and carrier-internal metadata are stripped.
data[].id	string	-	Unique identifier for this resource.
data[].status	enum	Allowed: READY_TO_SHIP, SHIPPED, DELIVERED, CANCELLED, RETURN_REFUND	Current status for this resource or workflow.
data[].sellerId	string	-	Seller ID associated with this value.
data[].customerId	string	-	Customer ID associated with this order.
data[].buyerEmail	string<email>	Format: email	Buyer email address. Returned by GET /orders and GET /orders/{id} only, and only when the app holds the `customer:email:read` scope. Absent otherwise, and never present on webhook payloads.
data[].currency	string	-	ISO currency code for monetary amounts.
data[].subtotal	integer	-	Integer amount in PHP centavos.
data[].total	integer	-	Integer amount in PHP centavos.
data[].tax	integer	-	Integer amount in PHP centavos.
data[].shipping	integer	-	Integer amount in PHP centavos.
data[].discount	integer	-	Integer amount in PHP centavos.
data[].paymentStatus	string	-	Current payment status for the order.
data[].fulfillmentStatus	string	-	Current fulfillment status for the order.
data[].created_at	string<date-time>	Format: date-time	Created at as an ISO-8601 timestamp.
data[].updated_at	string<date-time>	Format: date-time	Updated at as an ISO-8601 timestamp.
data[].items	array<OrderItem>	-	Items associated with this request, response, or event.
data[].items[]	OrderItem	No additional properties	A partner-visible order line item.
data[].fulfillments	array<Fulfillment>	-	Fulfillments values.
data[].fulfillments[]	Fulfillment	No additional properties	Partner-safe fulfillment view. Carrier-internal fields are stripped at the API boundary.
data[].shippingAddress	Address	No additional properties	Shipping address details.
data[].billingAddress	Address	No additional properties	Billing address details.
data[].shipByDate	string<date-time>	Format: date-time; Nullable	Ship-by SLA deadline (ISO-8601), or null when the order has no SBD. Matches the deadline shown in Seller Center.
data[].slaBreached	boolean	-	True when the order is unshipped and past its shipByDate. Present only when a deadline exists; false once the order has shipped (SLA no longer applicable).
data[].shippingChannel	string	-	The forward logistics channel code the order ships via (e.g. "STANDARD_COURIER"), sourced from the order's selected channel. A routing key for WMS integration. Omitted when no channel has been assigned yet.
data[].bookingStatus	enum	Allowed: PENDING_ARRANGE, READY_FOR_HANDOVER	Pre-shipment booking state. PENDING_ARRANGE means paid but unbooked; READY_FOR_HANDOVER means booking arranged and awaiting courier pickup. Omitted after courier handover progresses beyond the pre-shipment booking window.
meta	PaginationMeta	-	Response metadata, including pagination when the endpoint returns a list.
meta.page	integer	-	1-based page number represented by this response page.
meta.limit	integer	-	Maximum number of records returned in this response page.
meta.total	integer	-	Total number of records matching the request filters.

data[].items[]OrderItem · 10 fields

A partner-visible order line item.

Field	Type	Rules	Description
data[].items[].id	string	-	Line-item identifier, unique within the order.
data[].items[].orderId	string	-	Order the line item belongs to.
data[].items[].productId	string	-	Product the line item was created from.
data[].items[].variantId	string	-	Variant of the product that was ordered. Absent when the upstream record carries no variant.
data[].items[].title	string	-	Product title as it appeared on the order.
data[].items[].sku	string	-	Seller SKU of the ordered variant.
data[].items[].quantity	integer	-	Units ordered for this line.
data[].items[].unitPrice	integer	-	Integer amount in PHP centavos.
data[].items[].totalPrice	integer	-	Integer amount in PHP centavos.
data[].items[].thumbnail	string	-	Product thumbnail URL. Present only when the upstream record carries one.

data[].fulfillments[]Fulfillment · 10 fields

Partner-safe fulfillment view. Carrier-internal fields are stripped at the API boundary.

Field	Type	Rules	Description
data[].fulfillments[].id	string	-	Unique identifier for this resource.
data[].fulfillments[].status	enum	Allowed: pending, shipped, delivered, cancelled	Current status for this resource or workflow.
data[].fulfillments[].orderId	string	-	Order ID associated with this value.
data[].fulfillments[].trackingNumber	string	-	Partner-provided tracking number.
data[].fulfillments[].trackingCompany	string	-	Partner-provided tracking company name.
data[].fulfillments[].created_at	string<date-time>	Format: date-time	Created at as an ISO-8601 timestamp.
data[].fulfillments[].updated_at	string<date-time>	Format: date-time	Updated at as an ISO-8601 timestamp.
data[].fulfillments[].items	array<FulfillmentItem>	-	Items associated with this request, response, or event.
data[].fulfillments[].items[]	FulfillmentItem	No additional properties	A line item included in a fulfillment response.
data[].fulfillments[].metadata	FulfillmentMetadata	No additional properties	Allowlisted partner-visible metadata.

data[].fulfillments[].items[]FulfillmentItem · 2 fields

A line item included in a fulfillment response.

Field	Type	Rules	Description
data[].fulfillments[].items[].itemId	string	-	Line item ID.
data[].fulfillments[].items[].quantity	integer	-	Quantity of units.

data[].fulfillments[].metadataFulfillmentMetadata · 2 fields

Allowlisted partner-visible metadata.

Field	Type	Rules	Description
data[].fulfillments[].metadata.tracking_number	string	-	Shipment tracking number.
data[].fulfillments[].metadata.tracking_company	string	-	Shipment tracking company name.

data[].shippingAddressAddress · 8 fields

Shipping address details.

Field	Type	Rules	Description
data[].shippingAddress.name	string	-	Partner-visible name.
data[].shippingAddress.line1	string	-	First line of the street address.
data[].shippingAddress.line2	string	-	Second line of the street address, when present.
data[].shippingAddress.city	string	-	PSGC-aligned Philippine city or municipality.
data[].shippingAddress.province	string	-	PSGC-aligned Philippine province.
data[].shippingAddress.postalCode	string	-	Postal code for the address.
data[].shippingAddress.country	string	-	ISO 3166-1 alpha-2 country code.
data[].shippingAddress.phone	string	-	Contact phone number.

data[].billingAddressAddress · 8 fields

Billing address details.

Field	Type	Rules	Description
data[].billingAddress.name	string	-	Partner-visible name.
data[].billingAddress.line1	string	-	First line of the street address.
data[].billingAddress.line2	string	-	Second line of the street address, when present.
data[].billingAddress.city	string	-	PSGC-aligned Philippine city or municipality.
data[].billingAddress.province	string	-	PSGC-aligned Philippine province.
data[].billingAddress.postalCode	string	-	Postal code for the address.
data[].billingAddress.country	string	-	ISO 3166-1 alpha-2 country code.
data[].billingAddress.phone	string	-	Contact phone number.

Error Codes

HTTP Status	Schema	Description
400	ErrorResponse	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	ErrorResponse	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	ErrorResponse	Forbidden — insufficient scope
429	ErrorResponse	The partner or endpoint rate limit has been exceeded
502	ErrorResponse	The upstream commerce service rejected the request or returned an invalid response
503	ErrorResponse	A required platform or upstream dependency is temporarily unavailable
504	ErrorResponse	The upstream commerce service did not respond before the platform timeout

Machine-readable codes are returned in error.code: ACCOUNT_LOCKED, APPROVE_FAILED, APP_LIMIT_REACHED, APP_NOT_FOUND, AUTHORIZATION_CODE_EXPIRED, AUTHORIZATION_REVOKED, AUTH_CODE_EXPIRED, AUTH_CODE_USED, BAD_REQUEST, CANCELLATION_ALREADY_PROCESSED, CANCELLATION_DEADLINE_EXCEEDED, CANCEL_FAILED, CANNOT_DELETE_ACCOUNT_WITH_APPS, CONCURRENT_MODIFICATION, CONFLICT, CREATE_FAILED, DISPUTE_FAILED, DUPLICATE, EMAIL_ALREADY_EXISTS, EMAIL_NOT_VERIFIED, FILE_TOO_LARGE, FORBIDDEN, HMAC_VERSION_DEPRECATED, IDEMPOTENCY_KEY_IN_PROGRESS, IDEMPOTENCY_KEY_REQUIRED, IDEMPOTENCY_KEY_REUSED, INTERNAL_ERROR, INVALID_AUTHORIZATION_CODE, INVALID_CREDENTIALS, INVALID_DEVELOPER_TYPE, INVALID_FILE_CONTENT, INVALID_FILE_TYPE, INVALID_JSON, INVALID_NONCE, INVALID_PATH, INVALID_PICKUP_DATE, INVALID_REFRESH_TOKEN, INVALID_REQUEST, INVALID_SIGNATURE, INVALID_STATE, INVALID_TRANSITION, INVALID_VERIFICATION_TOKEN, MAINTENANCE, MEMBER_PERMISSION_DENIED, MISSING_NONCE, NONCE_REUSED, NOT_FOUND, NOT_IMPLEMENTED, ORDER_NOT_CANCELLABLE, PAYLOAD_TOO_LARGE, PICKUP_DATES_UNAVAILABLE, PRODUCT_HAS_ACTIVE_ORDERS, PRODUCT_UNDER_REVIEW, PROFILE_ALREADY_SUBMITTED, PROFILE_TYPE_MISMATCH, PROXY_ERROR, RATE_LIMITED, REDIRECT_URL_MISMATCH, REFRESH_TOKEN_EXPIRED, REFRESH_TOKEN_REUSED, REJECT_FAILED, RETURN_ALREADY_PROCESSED, RETURN_DEADLINE_EXCEEDED, RE_AUTHORIZATION_REQUIRED, SANDBOX_LIMIT_REACHED, SELLER_TOKEN_REQUIRED, SERVICE_UNAVAILABLE, SESSION_EXPIRED, SHIPMENT_ALREADY_ARRANGED, SHIPMENT_NOT_ARRANGED, SHIPPING_LABEL_UNAVAILABLE, SHIP_FAILED, SIGNATURE_REPLAYED, SSRF_CHECK_FAILED, TEST_SHOP_LIMIT_REACHED, TIMESTAMP_EXPIRED, TOKEN_REVOKED, TOO_MANY_REQUESTS, UNAUTHORIZED, UPLOAD_ERROR, UPLOAD_NOT_CONFIGURED, UPSTREAM_ERROR, UPSTREAM_TIMEOUT, VALIDATION_ERROR, VERIFICATION_LINK_USED, VERIFICATION_TOKEN_EXPIRED, WEBHOOK_SUBSCRIPTION_EXISTS

Examples

Executable examples are hidden for this endpoint until copy-paste guidance is published.