API reference / Sandbox

Get a sandbox test order's handover/tracking status after a mock booking or shipment.

GET/open/v1/sandbox/orders/{id}/trackingScope: No data scope

Service Endpoint Seller token not required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/sandbox/orders/{id}/tracking`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/sandbox/orders/{id}/tracking`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Conditional	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Conditional	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

Name	In	Type	Required	Rules	Description
id	path	string	Yes	-	The sandbox order ID.

Request Body

This operation has no JSON request body.

Response Parameters

Success status: HTTP 200

Field	Type	Rules	Description
success	boolean	-	Whether the request completed successfully.
data	OrderTracking	No additional properties	Response or event payload for this schema.
data.order_id	string	-	Order ID associated with this value.
data.tracking_number	string	-	Carrier tracking number.
data.current_status	string	Nullable	Status of the most recent tracking_update event received from the carrier. null when no scan events have been received yet.
data.handover_status	enum	Allowed: READY_FOR_HANDOVER, IN_TRANSIT, SHIPPED, DELIVERED	Explicit shipment handover/progress state. READY_FOR_HANDOVER means the booking is arranged and the parcel is awaiting courier pickup.
data.latest_event	TrackingEvent	Nullable; No additional properties	The most recent carrier tracking event (timestamp + location + status + description). null when no tracking events have been received.
data.latest_event.timestamp	string<date-time>	Format: date-time	ISO-8601 timestamp of the scan.
data.latest_event.location	string	-	Sanitized scan location (city/province or hub label). May be empty.
data.latest_event.status	string	-	Resolved tracking status code at the time of the scan.
data.latest_event.description	string	-	Human-readable description of the scan event.

Error Codes

HTTP Status	Schema	Description
400	PlatformError400Response	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	PlatformError401Response	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	PlatformError403Response	Forbidden — insufficient scope
404	PlatformError404Response	The requested resource does not exist or is not visible to the authenticated seller
429	PlatformError429Response	The partner or endpoint rate limit has been exceeded
503	PlatformError503Response	A required platform or upstream dependency is temporarily unavailable

This operation does not declare its own error.code list. Any operation can return the authentication, signing, scope, rate-limit and system codes listed in the Error code reference.

Request Example

curl -X GET "https://sandbox.open.mallplus.ph/open/v1/sandbox/orders/id_123/tracking" \
  -H "X-MallPlus-Partner-Id: mp_partner_123" \
  -H "X-MallPlus-Timestamp: 1786924800" \
  -H "X-MallPlus-Signature-Version: 3" \
  -H "X-MallPlus-Nonce: 4f8b9a0c4d5e6f708192a3b4c5d6e7f8" \
  -H "X-MallPlus-Signature: <hex_hmac_sha256>"

Response Example

{
  "success": true,
  "data": {
    "order_id": "ord_01ABC",
    "tracking_number": "TRK1234567890",
    "current_status": "shipped",
    "handover_status": "READY_FOR_HANDOVER",
    "latest_event": {
      "timestamp": "2026-07-10T08:30:00.000Z",
      "location": "MNL Gateway",
      "status": "shipped",
      "description": "Parcel picked up by carrier."
    }
  }
}