API reference / Usage & logs

Get the authenticated app's API call statistics; pass granularity=daily|hourly for a time-series (daily 90d, hourly 7d, UTC buckets)

GET/open/v1/usageScope: No data scope

Service Endpoint Seller token not required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/usage`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/usage`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Conditional	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Conditional	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

Name	In	Type	Required	Rules	Description
from	query	string<date-time>	No	Format: date-time	Start of the filter window as an ISO-8601 timestamp.
to	query	string<date-time>	No	Format: date-time	End of the filter window as an ISO-8601 timestamp.
endpoint	query	string	No	-	Endpoint path or route pattern to filter usage and access-log rows.
granularity	query	enum	No	Allowed: daily, hourly	Time-series bucket size for usage metrics.

Request Body

This operation has no JSON request body.

Response Parameters

Field	Type	Rules	Description
success	enum	Allowed: true	Whether the usage read succeeded.
data	object	No additional properties	Response or event payload for this schema.
data.summary	object	No additional properties	Totals across every endpoint in the window.
data.summary.successRate	number	-	Share of calls that succeeded, from 0 to 1.
data.summary.successCalls	integer	-	Calls that returned a 2xx status.
data.summary.failCalls	integer	-	Calls that returned a non-2xx status.
data.summary.totalCalls	integer	-	All calls in the window.
data.endpoints	array<ApiCallEndpointStats>	-	Per-endpoint breakdown.
data.endpoints[]	ApiCallEndpointStats	No additional properties	Call counts for one endpoint over the requested window.
data.endpoints[].endpoint	string	-	Endpoint path or route pattern the counts belong to.
data.endpoints[].successCalls	integer	-	Calls that returned a 2xx status.
data.endpoints[].failCalls	integer	-	Calls that returned a non-2xx status.
data.endpoints[].totalCalls	integer	-	All calls to this endpoint in the window.
data.endpoints[].successRate	number	-	Share of calls that succeeded, from 0 to 1.
data.quota	QuotaMeter	No additional properties	Quota details.
data.quota.window	enum	Allowed: per_minute	Window the meter counts over.
data.quota.limit	integer	-	Requests allowed in the window for this app.
data.quota.used	integer	-	Requests already charged against the current window.
data.quota.remaining	integer	-	Requests still available in the current window.
data.quota.resetAt	integer	Nullable	Unix seconds at which the current window resets. Null when the app is idle (no open window) or the meter store is unavailable.
data.series	object	No additional properties	Time series. Present only when the request passes granularity.
data.series.granularity	enum	Allowed: daily, hourly	Bucket size of the series.
data.series.from	string<date-time>	Format: date-time	Start of the series window, in UTC. ISO-8601 timestamp.
data.series.to	string<date-time>	Format: date-time	End of the series window, in UTC. ISO-8601 timestamp.
data.series.buckets	array<ApiCallSeriesBucket>	-	Buckets in chronological order.
data.series.buckets[]	ApiCallSeriesBucket	No additional properties	One time bucket of the usage series.
data.series.buckets[].ts	string<date-time>	Format: date-time	Start of the bucket, in UTC. ISO-8601 timestamp.
data.series.buckets[].totalCalls	integer	-	All calls in this bucket.
data.series.buckets[].successCalls	integer	-	Calls that returned a 2xx status.
data.series.buckets[].failCalls	integer	-	Calls that returned a non-2xx status.

Error Codes

HTTP Status	Schema	Description
400	ErrorResponse	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	ErrorResponse	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	ErrorResponse	Forbidden — insufficient scope
429	ErrorResponse	The partner or endpoint rate limit has been exceeded
503	ErrorResponse	A required platform or upstream dependency is temporarily unavailable

Machine-readable codes are returned in error.code: ACCOUNT_LOCKED, APPROVE_FAILED, APP_LIMIT_REACHED, APP_NOT_FOUND, AUTHORIZATION_CODE_EXPIRED, AUTHORIZATION_REVOKED, AUTH_CODE_EXPIRED, AUTH_CODE_USED, BAD_REQUEST, CANCELLATION_ALREADY_PROCESSED, CANCELLATION_DEADLINE_EXCEEDED, CANCEL_FAILED, CANNOT_DELETE_ACCOUNT_WITH_APPS, CONCURRENT_MODIFICATION, CONFLICT, CREATE_FAILED, DISPUTE_FAILED, DUPLICATE, EMAIL_ALREADY_EXISTS, EMAIL_NOT_VERIFIED, FILE_TOO_LARGE, FORBIDDEN, HMAC_VERSION_DEPRECATED, IDEMPOTENCY_KEY_IN_PROGRESS, IDEMPOTENCY_KEY_REQUIRED, IDEMPOTENCY_KEY_REUSED, INTERNAL_ERROR, INVALID_AUTHORIZATION_CODE, INVALID_CREDENTIALS, INVALID_DEVELOPER_TYPE, INVALID_FILE_CONTENT, INVALID_FILE_TYPE, INVALID_JSON, INVALID_NONCE, INVALID_PATH, INVALID_PICKUP_DATE, INVALID_REFRESH_TOKEN, INVALID_REQUEST, INVALID_SIGNATURE, INVALID_STATE, INVALID_TRANSITION, INVALID_VERIFICATION_TOKEN, MAINTENANCE, MEMBER_PERMISSION_DENIED, MISSING_NONCE, NONCE_REUSED, NOT_FOUND, NOT_IMPLEMENTED, ORDER_NOT_CANCELLABLE, PAYLOAD_TOO_LARGE, PICKUP_DATES_UNAVAILABLE, PRODUCT_HAS_ACTIVE_ORDERS, PRODUCT_UNDER_REVIEW, PROFILE_ALREADY_SUBMITTED, PROFILE_TYPE_MISMATCH, PROXY_ERROR, RATE_LIMITED, REDIRECT_URL_MISMATCH, REFRESH_TOKEN_EXPIRED, REFRESH_TOKEN_REUSED, REJECT_FAILED, RETURN_ALREADY_PROCESSED, RETURN_DEADLINE_EXCEEDED, RE_AUTHORIZATION_REQUIRED, SANDBOX_LIMIT_REACHED, SELLER_TOKEN_REQUIRED, SERVICE_UNAVAILABLE, SESSION_EXPIRED, SHIPMENT_ALREADY_ARRANGED, SHIPMENT_NOT_ARRANGED, SHIPPING_LABEL_UNAVAILABLE, SHIP_FAILED, SIGNATURE_REPLAYED, SSRF_CHECK_FAILED, TEST_SHOP_LIMIT_REACHED, TIMESTAMP_EXPIRED, TOKEN_REVOKED, TOO_MANY_REQUESTS, UNAUTHORIZED, UPLOAD_ERROR, UPLOAD_NOT_CONFIGURED, UPSTREAM_ERROR, UPSTREAM_TIMEOUT, VALIDATION_ERROR, VERIFICATION_LINK_USED, VERIFICATION_TOKEN_EXPIRED, WEBHOOK_SUBSCRIPTION_EXISTS

Request Example

curl -X GET "https://open.mallplus.ph/open/v1/usage" \
  -H "X-MallPlus-Partner-Id: mp_partner_123" \
  -H "X-MallPlus-Timestamp: 1786924800" \
  -H "X-MallPlus-Signature-Version: 3" \
  -H "X-MallPlus-Nonce: 4f8b9a0c4d5e6f708192a3b4c5d6e7f8" \
  -H "X-MallPlus-Signature: <hex_hmac_sha256>"

Response Example

{
  "success": true,
  "data": {
    "summary": {
      "successRate": 0.98,
      "successCalls": 490,
      "failCalls": 10,
      "totalCalls": 500
    },
    "endpoints": [
      {
        "endpoint": "/open/v1/orders",
        "successCalls": 300,
        "failCalls": 4,
        "totalCalls": 304,
        "successRate": 0.9868
      },
      {
        "endpoint": "/open/v1/products",
        "successCalls": 190,
        "failCalls": 6,
        "totalCalls": 196,
        "successRate": 0.9694
      }
    ],
    "quota": {
      "window": "per_minute",
      "limit": 600,
      "used": 42,
      "remaining": 558,
      "resetAt": 1787649944
    },
    "series": {
      "granularity": "daily",
      "from": "2026-08-19T00:00:00.000Z",
      "to": "2026-08-26T00:00:00.000Z",
      "buckets": [
        {
          "ts": "2026-08-25T00:00:00.000Z",
          "totalCalls": 120,
          "successCalls": 118,
          "failCalls": 2
        }
      ]
    }
  }
}