API reference / Auth

Validate and return the registered redirect URL after seller denial

POST/open/v1/auth/denyScope: No data scope

Service Endpoint Seller token not required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/auth/deny`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/auth/deny`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Conditional	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Conditional	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

This operation does not define path or query parameters in OpenAPI.

Request Body required

Field	Type	Required	Rules	Description
client_id	string	Yes	Min length: 1	Partner application client ID.
redirect_uri	string<uri>	Yes	Format: uri	Registered redirect URI for the OAuth flow.
state	string	No	Max length: 1024	State value.

Response Parameters

Success status: HTTP 200

Field	Type	Rules	Description
success	enum	Allowed: true	Whether the request completed successfully.
data	DenyAuthorizationData	No additional properties	Response or event payload for this schema.
data.redirect_uri	string<uri>	Format: uri	Registered redirect URI validated for the denied authorization request.
data.state	string	Max length: 1024	Opaque state supplied by the partner, returned unchanged when present.

Error Codes

HTTP Status	Schema	Description
400	PlatformError400Response	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	PlatformError401Response	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	PlatformError403Response	Forbidden — insufficient scope
413	PlatformError413Response	The request body exceeds the endpoint payload limit
429	PlatformError429Response	The partner or endpoint rate limit has been exceeded
503	PlatformError503Response	A required platform or upstream dependency is temporarily unavailable

This operation does not declare its own error.code list. Any operation can return the authentication, signing, scope, rate-limit and system codes listed in the Error code reference.

Request Example

# Sandbox: https://sandbox.open.mallplus.ph/open/v1/auth/deny
curl -X POST "https://open.mallplus.ph/open/v1/auth/deny" \
  -H "X-MallPlus-Partner-Id: mp_partner_123" \
  -H "X-MallPlus-Timestamp: 1786924800" \
  -H "X-MallPlus-Signature-Version: 3" \
  -H "X-MallPlus-Nonce: 4f8b9a0c4d5e6f708192a3b4c5d6e7f8" \
  -H "X-MallPlus-Signature: <hex_hmac_sha256>" \
  -H "Content-Type: application/json" \
  --data '{
  "client_id": "client_id_123",
  "redirect_uri": "https://example.com/resource",
  "state": "example_state"
}'

Response Example

{
  "success": true,
  "data": {
    "redirect_uri": "https://partner.example.com/callback",
    "state": "partner-generated-csrf-state"
  }
}