API reference / Orders

Cancel multiple orders in a single request (max 50)

POST/open/v1/orders/bulk-cancelScope: orders:write

Service Endpoint Seller token required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/orders/bulk-cancel`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/orders/bulk-cancel`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Yes	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Yes	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

Name	In	Type	Required	Rules	Description
Idempotency-Key	header	string	Yes	Min length: 1	Unique key, generated per request, used to safely retry this call.

Request Body required

Field	Type	Required	Rules	Description
orders	array<OrderBulkCancelItemRequest>	Yes	Min items: 1; Max items: 1000	Orders values.
orders[]	OrderBulkCancelItemRequest	No	No additional properties	An order cancellation instruction included in a bulk cancel request.
orders[].orderId	string	Yes	Min length: 1	Order ID associated with this value.
orders[].expectedStatus	enum	No	Allowed: PENDING, PAID, READY_TO_SHIP, SHIPPED, DELIVERED, CANCELLED	Optional compare-and-swap guard. When supplied, the transition only applies if the order is still in this status. PENDING, PAID, and READY_TO_SHIP are treated as the same pre-shipment state for this guard.

Response Parameters

Field	Type	Rules	Description
success	enum	Allowed: true	Whether the bulk request was processed.
data	object	No additional properties	Response or event payload for this schema.
data.cancelled	array<BulkOrderOutcome>	-	Orders that were cancelled.
data.cancelled[]	BulkOrderOutcome	No additional properties	One order that the bulk request processed successfully.
data.errors	array<BulkOrderError>	-	Orders that could not be cancelled. Empty when every order succeeded.
data.errors[]	BulkOrderError	No additional properties	One order the bulk request could not process.
data.summary	BulkOrderSummary	No additional properties	Summary details.

data.cancelled[]BulkOrderOutcome · 2 fields

One order that the bulk request processed successfully.

Field	Type	Rules	Description
data.cancelled[].orderId	string	-	Order that was processed.
data.cancelled[].status	string	-	State the order is now in.

data.errors[]BulkOrderError · 3 fields

One order the bulk request could not process.

Field	Type	Rules	Description
data.errors[].orderId	string	-	Order that failed.
data.errors[].error	string	-	Why this order could not be processed.
data.errors[].code	string	-	Machine-readable reason, when the failure maps to a catalogued error code.

data.summaryBulkOrderSummary · 3 fields

Summary details.

Field	Type	Rules	Description
data.summary.total	integer	-	Number of orders submitted.
data.summary.succeeded	integer	-	Number of orders processed successfully.
data.summary.failed	integer	-	Number of orders that failed.

Error Codes

HTTP Status	Schema	Description
400	ErrorResponse	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	ErrorResponse	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	ErrorResponse	Forbidden — insufficient scope
409	ErrorResponse	The request conflicts with the current resource state or reuses an idempotency key
413	ErrorResponse	The request body exceeds the endpoint payload limit
422	ErrorResponse	The request is well-formed but cannot be processed in the resource’s current state
429	ErrorResponse	The partner or endpoint rate limit has been exceeded
502	ErrorResponse	The upstream commerce service rejected the request or returned an invalid response
503	ErrorResponse	A required platform or upstream dependency is temporarily unavailable
504	ErrorResponse	The upstream commerce service did not respond before the platform timeout

Machine-readable codes are returned in error.code: ACCOUNT_LOCKED, APPROVE_FAILED, APP_LIMIT_REACHED, APP_NOT_FOUND, AUTHORIZATION_CODE_EXPIRED, AUTHORIZATION_REVOKED, AUTH_CODE_EXPIRED, AUTH_CODE_USED, BAD_REQUEST, CANCELLATION_ALREADY_PROCESSED, CANCELLATION_DEADLINE_EXCEEDED, CANCEL_FAILED, CANNOT_DELETE_ACCOUNT_WITH_APPS, CONCURRENT_MODIFICATION, CONFLICT, CREATE_FAILED, DISPUTE_FAILED, DUPLICATE, EMAIL_ALREADY_EXISTS, EMAIL_NOT_VERIFIED, FILE_TOO_LARGE, FORBIDDEN, HMAC_VERSION_DEPRECATED, IDEMPOTENCY_KEY_IN_PROGRESS, IDEMPOTENCY_KEY_REQUIRED, IDEMPOTENCY_KEY_REUSED, INTERNAL_ERROR, INVALID_AUTHORIZATION_CODE, INVALID_CREDENTIALS, INVALID_DEVELOPER_TYPE, INVALID_FILE_CONTENT, INVALID_FILE_TYPE, INVALID_JSON, INVALID_NONCE, INVALID_PATH, INVALID_PICKUP_DATE, INVALID_REFRESH_TOKEN, INVALID_REQUEST, INVALID_SIGNATURE, INVALID_STATE, INVALID_TRANSITION, INVALID_VERIFICATION_TOKEN, MAINTENANCE, MEMBER_PERMISSION_DENIED, MISSING_NONCE, NONCE_REUSED, NOT_FOUND, NOT_IMPLEMENTED, ORDER_NOT_CANCELLABLE, PAYLOAD_TOO_LARGE, PICKUP_DATES_UNAVAILABLE, PRODUCT_HAS_ACTIVE_ORDERS, PRODUCT_UNDER_REVIEW, PROFILE_ALREADY_SUBMITTED, PROFILE_TYPE_MISMATCH, PROXY_ERROR, RATE_LIMITED, REDIRECT_URL_MISMATCH, REFRESH_TOKEN_EXPIRED, REFRESH_TOKEN_REUSED, REJECT_FAILED, RETURN_ALREADY_PROCESSED, RETURN_DEADLINE_EXCEEDED, RE_AUTHORIZATION_REQUIRED, SANDBOX_LIMIT_REACHED, SELLER_TOKEN_REQUIRED, SERVICE_UNAVAILABLE, SESSION_EXPIRED, SHIPMENT_ALREADY_ARRANGED, SHIPMENT_NOT_ARRANGED, SHIPPING_LABEL_UNAVAILABLE, SHIP_FAILED, SIGNATURE_REPLAYED, SSRF_CHECK_FAILED, TEST_SHOP_LIMIT_REACHED, TIMESTAMP_EXPIRED, TOKEN_REVOKED, TOO_MANY_REQUESTS, UNAUTHORIZED, UPLOAD_ERROR, UPLOAD_NOT_CONFIGURED, UPSTREAM_ERROR, UPSTREAM_TIMEOUT, VALIDATION_ERROR, VERIFICATION_LINK_USED, VERIFICATION_TOKEN_EXPIRED, WEBHOOK_SUBSCRIPTION_EXISTS

Request Example

curl -X POST "https://open.mallplus.ph/open/v1/orders/bulk-cancel" \
  -H "X-MallPlus-Partner-Id: mp_partner_123" \
  -H "X-MallPlus-Timestamp: 1786924800" \
  -H "X-MallPlus-Signature-Version: 3" \
  -H "X-MallPlus-Nonce: 4f8b9a0c4d5e6f708192a3b4c5d6e7f8" \
  -H "X-MallPlus-Signature: <hex_hmac_sha256>" \
  -H "X-MallPlus-Access-Token: seller_access_token" \
  -H "X-MallPlus-Seller-Id: seller_123" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  --data '{
  "orders": [
    {
      "orderId": "orderId_123",
      "expectedStatus": "PENDING"
    }
  ]
}'

Response Example

{
  "success": true,
  "data": {
    "cancelled": [
      {
        "orderId": "QPS3OJQ6DF2QNL",
        "status": "cancelled"
      }
    ],
    "errors": [],
    "summary": {
      "total": 1,
      "succeeded": 1,
      "failed": 0
    }
  }
}