API reference / Sandbox

Get a sandbox test order by ID

GET/open/v1/sandbox/orders/{id}Scope: No data scope

Service Endpoint Seller token not required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/sandbox/orders/{id}`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/sandbox/orders/{id}`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Conditional	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Conditional	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

Name	In	Type	Required	Rules	Description
id	path	string	Yes	-	The sandbox order ID.

Request Body

This operation has no JSON request body.

Response Parameters

Success status: HTTP 200

Field	Type	Rules	Description
success	boolean	-	Whether the request completed successfully.
data	SandboxOrder	No additional properties	Response or event payload for this schema.
data.id	string	-	Unique identifier for this resource.
data.status	enum	Allowed: READY_TO_SHIP, SHIPPED, DELIVERED, CANCELLED, RETURN_REFUND, PENDING	Current status for this resource or workflow.
data.sellerId	string	-	Shop ID of the seller that owns the order. Returned on sandbox orders only; production order responses do not currently include it. Every order route is scoped to the seller your access token belongs to, so the owner is always that seller.
data.customerId	string	-	ID of the buyer who placed the order. On production, returned by GET /orders/{id}: the platform customer ID, stable across that buyer's orders, so use it to attribute orders to one customer. Not currently returned on GET /orders list rows on production. On the sandbox, the test-buyer ID of an order placed for a test buyer. It is an identifier only and the documented way to identify the buyer: production does not return buyer contact details (see buyerEmail and shippingAddress).
data.buyerEmail	string<email>	Format: email	Buyer email address. Not returned on production: buyer contact details are withheld by design to protect buyer privacy, and `customer:email:read` is reserved and does not release it. Use customerId to identify the buyer. Never present on webhook payloads.
data.currency	string	-	Currency code of the order (Philippine peso); compare it case-insensitively. Returned on GET /orders list rows and on sandbox orders. Not currently returned by GET /orders/{id} or by order action responses on production. The money fields on this object do not depend on it, so do not require currency to read them.
data.subtotal	number	-	Amount in PHP pesos, not centavos.
data.total	number	-	Amount in PHP pesos, not centavos.
data.tax	number	-	Amount in PHP pesos, not centavos.
data.shipping	number	-	Amount in PHP pesos, not centavos.
data.discount	number	-	Amount in PHP pesos, not centavos.
data.paymentStatus	string	-	Current payment status for the order.
data.fulfillmentStatus	string	-	Current fulfillment status for the order.
data.created_at	string<date-time>	Format: date-time	Created at as an ISO-8601 timestamp.
data.updated_at	string<date-time>	Format: date-time	Updated at as an ISO-8601 timestamp.
data.items	array<OrderItem>	-	Items associated with this request, response, or event.
data.items[]	OrderItem	No additional properties	A partner-visible order line item.
data.items[].id	string	-	Line-item identifier, unique within the order. The same value on every order read; pass it as items[].itemId to POST /open/v1/returns.
data.items[].orderId	string	-	Order the line item belongs to.
data.items[].productId	string	-	Product the line item was created from.
data.items[].variantId	string	-	Variant of the product that was ordered. Absent when the upstream record carries no variant.
data.items[].title	string	-	Product title as it appeared on the order.
data.items[].sku	string	-	Seller SKU of the ordered variant.
data.items[].quantity	integer	-	Units ordered for this line.
data.items[].unitPrice	number	-	Amount in PHP pesos, not centavos.
data.items[].totalPrice	number	-	Amount in PHP pesos, not centavos.
data.items[].thumbnail	string	-	Product thumbnail URL. Present only when the upstream record carries one.
data.fulfillments	array<Fulfillment>	-	Shipments recorded against the order. Returned by GET /orders/{id} once the order has a fulfillment, on production and sandbox, and absent before then. Not currently returned on GET /orders list rows on production; sandbox list rows include it. Carrier tracking events are on GET /orders/{id}/tracking, and the shipment state is on fulfillmentStatus and bookingStatus.
data.fulfillments[]	Fulfillment	No additional properties	Partner-safe fulfillment view. Carrier-internal fields are stripped at the API boundary.
data.fulfillments[].id	string	-	Unique identifier for this resource.
data.fulfillments[].status	enum	Allowed: pending, shipped, delivered, cancelled	Current status for this resource or workflow.
data.fulfillments[].orderId	string	-	Order ID associated with this value.
data.fulfillments[].trackingNumber	string	-	Partner-provided tracking number.
data.fulfillments[].trackingCompany	string	-	Partner-provided tracking company name.
data.fulfillments[].channel	enum	Allowed: pickup, dropoff	Handover method for the shipment: `pickup` (courier collects from the seller) or `dropoff` (seller drops off at a branch). Carrier-agnostic — the courier is reported separately via trackingCompany.
data.fulfillments[].created_at	string<date-time>	Format: date-time	Created at as an ISO-8601 timestamp.
data.fulfillments[].updated_at	string<date-time>	Format: date-time	Updated at as an ISO-8601 timestamp.
data.fulfillments[].items	array<FulfillmentItem>	-	Items associated with this request, response, or event.
data.fulfillments[].items[]	FulfillmentItem	No additional properties	A line item included in a fulfillment response.
data.fulfillments[].items[].itemId	string	-	Line-item identifier: the OrderItem.id of a line on the order, as returned by GET /open/v1/orders/{id} (items[].id) and GET /open/v1/orders/{id}/items (data[].id).
data.fulfillments[].items[].quantity	integer	-	Quantity of units.
data.fulfillments[].metadata	FulfillmentMetadata	No additional properties	Allowlisted partner-visible metadata.
data.fulfillments[].metadata.tracking_number	string	-	Shipment tracking number.
data.fulfillments[].metadata.tracking_company	string	-	Shipment tracking company name.
data.shippingAddress	Address	No additional properties	Delivery address, masked by design on production to protect buyer privacy: street lines and phone masked, no recipient name; city, province, postalCode and country as stored. `customer:contact:read` is reserved and does not unmask it. Use customerId to identify the buyer.
data.shippingAddress.id	string	-	Sandbox shipping-address identifier (`addr_*`), minted on POST /sandbox/buyers. Omitted on production orders.
data.shippingAddress.name	string	-	Recipient name. Not returned on production (withheld by design). Present on sandbox test orders.
data.shippingAddress.line1	string	-	First line of the street address. Masked by design on production (for example `••••••••••`).
data.shippingAddress.line2	string	-	Second line of the street address, when present. Masked by design on production.
data.shippingAddress.city	string	-	PSGC-aligned Philippine city or municipality.
data.shippingAddress.province	string	-	PSGC-aligned Philippine province.
data.shippingAddress.postalCode	string	-	Postal code for the address.
data.shippingAddress.country	string	-	ISO 3166-1 alpha-2 country code.
data.shippingAddress.phone	string	-	Recipient phone number. Masked by design on production (for example `••••••42`); `customer:contact:read` is reserved and does not unmask it.
data.billingAddress	Address	No additional properties	Billing address, when the order has one. Masked by design on production, the same way as shippingAddress.
data.billingAddress.id	string	-	Sandbox shipping-address identifier (`addr_*`), minted on POST /sandbox/buyers. Omitted on production orders.
data.billingAddress.name	string	-	Recipient name. Not returned on production (withheld by design). Present on sandbox test orders.
data.billingAddress.line1	string	-	First line of the street address. Masked by design on production (for example `••••••••••`).
data.billingAddress.line2	string	-	Second line of the street address, when present. Masked by design on production.
data.billingAddress.city	string	-	PSGC-aligned Philippine city or municipality.
data.billingAddress.province	string	-	PSGC-aligned Philippine province.
data.billingAddress.postalCode	string	-	Postal code for the address.
data.billingAddress.country	string	-	ISO 3166-1 alpha-2 country code.
data.billingAddress.phone	string	-	Recipient phone number. Masked by design on production (for example `••••••42`); `customer:contact:read` is reserved and does not unmask it.
data.shipByDate	string<date-time>	Format: date-time; Nullable	Ship-by SLA deadline (ISO-8601), or null when the order has no SBD. Matches the deadline shown in Seller Center.
data.slaBreached	boolean	-	True when the order is unshipped and past its shipByDate. Present only when a deadline exists; false once the order has shipped (SLA no longer applicable).
data.shippingChannel	string	-	The forward logistics channel code the order ships via (e.g. "STANDARD_COURIER"), sourced from the order's selected channel. A routing key for WMS integration. Omitted when no channel has been assigned yet.
data.bookingStatus	enum	Allowed: PENDING_ARRANGE, READY_FOR_HANDOVER	Pre-shipment booking state. PENDING_ARRANGE means paid but unbooked; READY_FOR_HANDOVER means booking arranged and awaiting courier pickup. Omitted after courier handover progresses beyond the pre-shipment booking window.

Error Codes

HTTP Status	Schema	Description
400	PlatformError400Response	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	PlatformError401Response	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	PlatformError403Response	Forbidden — insufficient scope
404	PlatformError404Response	The requested resource does not exist or is not visible to the authenticated seller
429	PlatformError429Response	The partner or endpoint rate limit has been exceeded
503	PlatformError503Response	A required platform or upstream dependency is temporarily unavailable

This operation does not declare its own error.code list. Any operation can return the authentication, signing, scope, rate-limit and system codes listed in the Error code reference.

Request Example

curl -X GET "https://sandbox.open.mallplus.ph/open/v1/sandbox/orders/id_123" \
  -H "X-MallPlus-Partner-Id: mp_partner_123" \
  -H "X-MallPlus-Timestamp: 1786924800" \
  -H "X-MallPlus-Signature-Version: 3" \
  -H "X-MallPlus-Nonce: 4f8b9a0c4d5e6f708192a3b4c5d6e7f8" \
  -H "X-MallPlus-Signature: <hex_hmac_sha256>"

Response Example

{
  "success": true,
  "data": {
    "id": "id_123",
    "status": "READY_TO_SHIP",
    "sellerId": "sellerId_123",
    "customerId": "customerId_123",
    "buyerEmail": "partner@example.com",
    "currency": "example_currency",
    "subtotal": 1,
    "total": 1,
    "tax": 1,
    "shipping": 1,
    "discount": 1,
    "paymentStatus": "example_paymentStatus",
    "fulfillmentStatus": "example_fulfillmentStatus",
    "created_at": "2026-08-17T00:00:00Z",
    "updated_at": "2026-08-17T00:00:00Z",
    "items": [
      {
        "id": "id_123",
        "orderId": "orderId_123",
        "productId": "productId_123",
        "variantId": "variantId_123",
        "title": "example_title",
        "sku": "example_sku",
        "quantity": 1,
        "unitPrice": 1,
        "totalPrice": 1,
        "thumbnail": "example_thumbnail"
      }
    ],
    "fulfillments": [
      {
        "id": "id_123",
        "status": "pending",
        "orderId": "orderId_123",
        "trackingNumber": "example_trackingNumber",
        "trackingCompany": "example_trackingCompany",
        "channel": "pickup",
        "created_at": "2026-08-17T00:00:00Z",
        "updated_at": "2026-08-17T00:00:00Z",
        "items": [
          {
            "itemId": "string",
            "quantity": "integer"
          }
        ],
        "metadata": {
          "tracking_number": "example_tracking_number",
          "tracking_company": "example_tracking_company"
        }
      }
    ],
    "shippingAddress": {
      "id": "id_123",
      "name": "example_name",
      "line1": "example_line1",
      "line2": "example_line2",
      "city": "example_city",
      "province": "example_province",
      "postalCode": "example_postalCode",
      "country": "example_country",
      "phone": "example_phone"
    },
    "billingAddress": {
      "id": "id_123",
      "name": "example_name",
      "line1": "example_line1",
      "line2": "example_line2",
      "city": "example_city",
      "province": "example_province",
      "postalCode": "example_postalCode",
      "country": "example_country",
      "phone": "example_phone"
    },
    "shipByDate": "2026-08-17T00:00:00Z",
    "slaBreached": true,
    "shippingChannel": "example_shippingChannel",
    "bookingStatus": "PENDING_ARRANGE"
  }
}