API reference / Sandbox

List test buyers for the authenticated sandbox app

GET/open/v1/sandbox/buyersScope: No data scope

Service Endpoint Seller token not required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/sandbox/buyers`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/sandbox/buyers`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Conditional	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Conditional	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

Name	In	Type	Required	Rules	Description
page	query	integer	No	Minimum: 1; Default: 1	1-based page number to return.
limit	query	integer	No	Minimum: 1; Maximum: 100; Default: 20	Maximum number of records to return.

Request Body

This operation has no JSON request body.

Response Parameters

Success status: HTTP 200

Field	Type	Rules	Description
success	boolean	-	Whether the sandbox buyer list request succeeded.
data	array<SandboxBuyer>	-	Sandbox buyers visible to the authenticated sandbox app.
data[]	SandboxBuyer	No additional properties	Partner-visible sandbox buyer used for buyer-driven order simulation.
data[].id	string	-	Sandbox buyer identifier used by sandbox order flows.
data[].name	string	-	Display name of the test buyer.
data[].email	string<email>	Format: email	Email address assigned to the test buyer.
data[].phoneNumber	string	-	Phone number assigned to the test buyer.
data[].shippingAddress	SandboxBuyerShippingAddress	No additional properties	Shipping address details.
data[].shippingAddress.id	string	-	Server-minted shipping-address identifier. Record this as ADDRESS-1; echoed on the order after place.
data[].shippingAddress.line1	string	-	Primary street address line.
data[].shippingAddress.line2	string	-	Optional secondary street address line such as unit or floor.
data[].shippingAddress.city	string	-	PSGC-aligned Philippine city or municipality.
data[].shippingAddress.region	string	-	PSGC-aligned Philippine region.
data[].shippingAddress.postalCode	string	-	Postal code for the sandbox buyer shipping address.
data[].shippingAddress.country	string	-	ISO 3166-1 alpha-2 country code for the shipping address.
data[].createdAt	string<date-time>	Format: date-time	ISO-8601 UTC timestamp when the sandbox buyer was created.
data[].updatedAt	string<date-time>	Format: date-time	ISO-8601 UTC timestamp when the sandbox buyer was last updated.
meta	SandboxListMeta	No additional properties	Response metadata, including pagination when the endpoint returns a list.
meta.totalCount	integer	Minimum: 0	Total number of sandbox records visible to the authenticated sandbox app.

Error Codes

HTTP Status	Schema	Description
400	PlatformError400Response	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	PlatformError401Response	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	PlatformError403Response	Forbidden — insufficient scope
429	PlatformError429Response	The partner or endpoint rate limit has been exceeded
503	PlatformError503Response	A required platform or upstream dependency is temporarily unavailable

This operation does not declare its own error.code list. Any operation can return the authentication, signing, scope, rate-limit and system codes listed in the Error code reference.

Request Example

curl -X GET "https://sandbox.open.mallplus.ph/open/v1/sandbox/buyers" \
  -H "X-MallPlus-Partner-Id: mp_partner_123" \
  -H "X-MallPlus-Timestamp: 1786924800" \
  -H "X-MallPlus-Signature-Version: 3" \
  -H "X-MallPlus-Nonce: 4f8b9a0c4d5e6f708192a3b4c5d6e7f8" \
  -H "X-MallPlus-Signature: <hex_hmac_sha256>"

Response Example

{
  "success": true,
  "data": [
    {
      "id": "buy_test_contract",
      "name": "Sandbox Buyer",
      "email": "sandbox-buyer@example.com",
      "phoneNumber": "+639001112233",
      "shippingAddress": {
        "id": "addr_test_contract",
        "line1": "1 Sandbox St",
        "city": "Manila",
        "region": "NCR",
        "postalCode": "1000",
        "country": "PH"
      },
      "createdAt": "2026-08-26T04:00:00.000Z",
      "updatedAt": "2026-08-26T04:00:00.000Z"
    }
  ],
  "meta": {
    "totalCount": 1
  }
}