API reference / Orders

Ship an order with tracking information

Single-order shipping is available with limited production-readiness confirmation.

POST/open/v1/orders/{id}/shipScope: orders:write

Service Endpoint Seller token required

Environment	Base URL + Path
Production	`https://open.mallplus.ph/open/v1/orders/{id}/ship`
Sandbox	`https://sandbox.open.mallplus.ph/open/v1/orders/{id}/ship`

Common Signing and Seller Headers

Header	Type	Required	Rules	Description
X-MallPlus-Partner-Id	string	Yes	Issued client ID for the calling app.	Identifies the partner app whose secret signs the request.
X-MallPlus-Timestamp	integer	Yes	Unix timestamp in seconds; default acceptance window is 90 seconds.	Prevents replay outside the allowed signing window.
X-MallPlus-Signature-Version	string	Yes	Use `3` for HMAC v3.	Selects the request signing algorithm.
X-MallPlus-Nonce	string	Yes	32-64 lowercase hexadecimal characters, unique per request.	Replay-protection nonce included in the v3 signing base string.
X-MallPlus-Signature	string	Yes	HMAC-SHA256 over timestamp, client ID, method, path, canonical query, body hash, and nonce.	Cryptographic proof that the request was signed with the app secret.
X-MallPlus-Access-Token	string	Yes	Required when the operation says seller token required.	Seller OAuth access token returned by the authorization flow.
X-MallPlus-Seller-Id	string	Yes	Required when `X-MallPlus-Access-Token` is required.	Seller ID bound to the seller OAuth token.

Parameters

Name	In	Type	Required	Rules	Description
id	path	string	Yes	-	The order ID.
Idempotency-Key	header	string	Yes	Min length: 1	Unique key, generated per request, used to safely retry this call.

Request Body required

Field	Type	Required	Rules	Description
trackingNumber	string	Yes	Min length: 1; Max length: 120	Partner-provided tracking number.
trackingCompany	string	Yes	Min length: 1; Max length: 80	Partner-provided tracking company name.
items	array<OrderItemQuantityRequest>	Yes	Min items: 1; Max items: 100	Items associated with this request, response, or event.
items[]	OrderItemQuantityRequest	No	No additional properties	A line item and the quantity to act on.
items[].itemId	string	Yes	Max length: 64	Line item ID.
items[].quantity	integer	Yes	Minimum: 1; Maximum: 1000000	Quantity of units.

Response Parameters

Field	Type	Rules	Description
success	boolean	-	Whether the request completed successfully.
data	Order	No additional properties	Response or event payload for this schema.
data.id	string	-	Unique identifier for this resource.
data.status	enum	Allowed: READY_TO_SHIP, SHIPPED, DELIVERED, CANCELLED, RETURN_REFUND	Current status for this resource or workflow.
data.sellerId	string	-	Seller ID associated with this value.
data.customerId	string	-	Customer ID associated with this order.
data.buyerEmail	string<email>	Format: email	Buyer email address. Returned by GET /orders and GET /orders/{id} only, and only when the app holds the `customer:email:read` scope. Absent otherwise, and never present on webhook payloads.
data.currency	string	-	ISO currency code for monetary amounts.
data.subtotal	integer	-	Integer amount in PHP centavos.
data.total	integer	-	Integer amount in PHP centavos.
data.tax	integer	-	Integer amount in PHP centavos.
data.shipping	integer	-	Integer amount in PHP centavos.
data.discount	integer	-	Integer amount in PHP centavos.
data.paymentStatus	string	-	Current payment status for the order.
data.fulfillmentStatus	string	-	Current fulfillment status for the order.
data.created_at	string<date-time>	Format: date-time	Created at as an ISO-8601 timestamp.
data.updated_at	string<date-time>	Format: date-time	Updated at as an ISO-8601 timestamp.
data.items	array<OrderItem>	-	Items associated with this request, response, or event.
data.items[]	OrderItem	No additional properties	A partner-visible order line item.
data.fulfillments	array<Fulfillment>	-	Fulfillments values.
data.fulfillments[]	Fulfillment	No additional properties	Partner-safe fulfillment view. Carrier-internal fields are stripped at the API boundary.
data.shippingAddress	Address	No additional properties	Shipping address details.
data.billingAddress	Address	No additional properties	Billing address details.
data.shipByDate	string<date-time>	Format: date-time; Nullable	Ship-by SLA deadline (ISO-8601), or null when the order has no SBD. Matches the deadline shown in Seller Center.
data.slaBreached	boolean	-	True when the order is unshipped and past its shipByDate. Present only when a deadline exists; false once the order has shipped (SLA no longer applicable).
data.shippingChannel	string	-	The forward logistics channel code the order ships via (e.g. "STANDARD_COURIER"), sourced from the order's selected channel. A routing key for WMS integration. Omitted when no channel has been assigned yet.
data.bookingStatus	enum	Allowed: PENDING_ARRANGE, READY_FOR_HANDOVER	Pre-shipment booking state. PENDING_ARRANGE means paid but unbooked; READY_FOR_HANDOVER means booking arranged and awaiting courier pickup. Omitted after courier handover progresses beyond the pre-shipment booking window.

data.items[]OrderItem · 10 fields

A partner-visible order line item.

Field	Type	Rules	Description
data.items[].id	string	-	Line-item identifier, unique within the order.
data.items[].orderId	string	-	Order the line item belongs to.
data.items[].productId	string	-	Product the line item was created from.
data.items[].variantId	string	-	Variant of the product that was ordered. Absent when the upstream record carries no variant.
data.items[].title	string	-	Product title as it appeared on the order.
data.items[].sku	string	-	Seller SKU of the ordered variant.
data.items[].quantity	integer	-	Units ordered for this line.
data.items[].unitPrice	integer	-	Integer amount in PHP centavos.
data.items[].totalPrice	integer	-	Integer amount in PHP centavos.
data.items[].thumbnail	string	-	Product thumbnail URL. Present only when the upstream record carries one.

data.fulfillments[]Fulfillment · 10 fields

Partner-safe fulfillment view. Carrier-internal fields are stripped at the API boundary.

Field	Type	Rules	Description
data.fulfillments[].id	string	-	Unique identifier for this resource.
data.fulfillments[].status	enum	Allowed: pending, shipped, delivered, cancelled	Current status for this resource or workflow.
data.fulfillments[].orderId	string	-	Order ID associated with this value.
data.fulfillments[].trackingNumber	string	-	Partner-provided tracking number.
data.fulfillments[].trackingCompany	string	-	Partner-provided tracking company name.
data.fulfillments[].created_at	string<date-time>	Format: date-time	Created at as an ISO-8601 timestamp.
data.fulfillments[].updated_at	string<date-time>	Format: date-time	Updated at as an ISO-8601 timestamp.
data.fulfillments[].items	array<FulfillmentItem>	-	Items associated with this request, response, or event.
data.fulfillments[].items[]	FulfillmentItem	No additional properties	A line item included in a fulfillment response.
data.fulfillments[].metadata	FulfillmentMetadata	No additional properties	Allowlisted partner-visible metadata.

data.fulfillments[].items[]FulfillmentItem · 2 fields

A line item included in a fulfillment response.

Field	Type	Rules	Description
data.fulfillments[].items[].itemId	string	-	Line item ID.
data.fulfillments[].items[].quantity	integer	-	Quantity of units.

data.fulfillments[].metadataFulfillmentMetadata · 2 fields

Allowlisted partner-visible metadata.

Field	Type	Rules	Description
data.fulfillments[].metadata.tracking_number	string	-	Shipment tracking number.
data.fulfillments[].metadata.tracking_company	string	-	Shipment tracking company name.

data.shippingAddressAddress · 8 fields

Shipping address details.

Field	Type	Rules	Description
data.shippingAddress.name	string	-	Partner-visible name.
data.shippingAddress.line1	string	-	First line of the street address.
data.shippingAddress.line2	string	-	Second line of the street address, when present.
data.shippingAddress.city	string	-	PSGC-aligned Philippine city or municipality.
data.shippingAddress.province	string	-	PSGC-aligned Philippine province.
data.shippingAddress.postalCode	string	-	Postal code for the address.
data.shippingAddress.country	string	-	ISO 3166-1 alpha-2 country code.
data.shippingAddress.phone	string	-	Contact phone number.

data.billingAddressAddress · 8 fields

Billing address details.

Field	Type	Rules	Description
data.billingAddress.name	string	-	Partner-visible name.
data.billingAddress.line1	string	-	First line of the street address.
data.billingAddress.line2	string	-	Second line of the street address, when present.
data.billingAddress.city	string	-	PSGC-aligned Philippine city or municipality.
data.billingAddress.province	string	-	PSGC-aligned Philippine province.
data.billingAddress.postalCode	string	-	Postal code for the address.
data.billingAddress.country	string	-	ISO 3166-1 alpha-2 country code.
data.billingAddress.phone	string	-	Contact phone number.

Error Codes

HTTP Status	Schema	Description
400	ErrorResponse	Validation error, or a missing/malformed required signing header (BAD_REQUEST)
401	ErrorResponse	Unauthorized — invalid credentials, invalid signature, or expired timestamp (TIMESTAMP_EXPIRED)
403	ErrorResponse	Forbidden — insufficient scope
404	ErrorResponse	The requested resource does not exist or is not visible to the authenticated seller
409	ErrorResponse	The request conflicts with the current resource state or reuses an idempotency key
413	ErrorResponse	The request body exceeds the endpoint payload limit
422	ErrorResponse	The request is well-formed but cannot be processed in the resource’s current state
429	ErrorResponse	The partner or endpoint rate limit has been exceeded
502	ErrorResponse	The upstream commerce service rejected the request or returned an invalid response
503	ErrorResponse	A required platform or upstream dependency is temporarily unavailable
504	ErrorResponse	The upstream commerce service did not respond before the platform timeout

Machine-readable codes are returned in error.code: ACCOUNT_LOCKED, APPROVE_FAILED, APP_LIMIT_REACHED, APP_NOT_FOUND, AUTHORIZATION_CODE_EXPIRED, AUTHORIZATION_REVOKED, AUTH_CODE_EXPIRED, AUTH_CODE_USED, BAD_REQUEST, CANCELLATION_ALREADY_PROCESSED, CANCELLATION_DEADLINE_EXCEEDED, CANCEL_FAILED, CANNOT_DELETE_ACCOUNT_WITH_APPS, CONCURRENT_MODIFICATION, CONFLICT, CREATE_FAILED, DISPUTE_FAILED, DUPLICATE, EMAIL_ALREADY_EXISTS, EMAIL_NOT_VERIFIED, FILE_TOO_LARGE, FORBIDDEN, HMAC_VERSION_DEPRECATED, IDEMPOTENCY_KEY_IN_PROGRESS, IDEMPOTENCY_KEY_REQUIRED, IDEMPOTENCY_KEY_REUSED, INTERNAL_ERROR, INVALID_AUTHORIZATION_CODE, INVALID_CREDENTIALS, INVALID_DEVELOPER_TYPE, INVALID_FILE_CONTENT, INVALID_FILE_TYPE, INVALID_JSON, INVALID_NONCE, INVALID_PATH, INVALID_PICKUP_DATE, INVALID_REFRESH_TOKEN, INVALID_REQUEST, INVALID_SIGNATURE, INVALID_STATE, INVALID_TRANSITION, INVALID_VERIFICATION_TOKEN, MAINTENANCE, MEMBER_PERMISSION_DENIED, MISSING_NONCE, NONCE_REUSED, NOT_FOUND, NOT_IMPLEMENTED, ORDER_NOT_CANCELLABLE, PAYLOAD_TOO_LARGE, PICKUP_DATES_UNAVAILABLE, PRODUCT_HAS_ACTIVE_ORDERS, PRODUCT_UNDER_REVIEW, PROFILE_ALREADY_SUBMITTED, PROFILE_TYPE_MISMATCH, PROXY_ERROR, RATE_LIMITED, REDIRECT_URL_MISMATCH, REFRESH_TOKEN_EXPIRED, REFRESH_TOKEN_REUSED, REJECT_FAILED, RETURN_ALREADY_PROCESSED, RETURN_DEADLINE_EXCEEDED, RE_AUTHORIZATION_REQUIRED, SANDBOX_LIMIT_REACHED, SELLER_TOKEN_REQUIRED, SERVICE_UNAVAILABLE, SESSION_EXPIRED, SHIPMENT_ALREADY_ARRANGED, SHIPMENT_NOT_ARRANGED, SHIPPING_LABEL_UNAVAILABLE, SHIP_FAILED, SIGNATURE_REPLAYED, SSRF_CHECK_FAILED, TEST_SHOP_LIMIT_REACHED, TIMESTAMP_EXPIRED, TOKEN_REVOKED, TOO_MANY_REQUESTS, UNAUTHORIZED, UPLOAD_ERROR, UPLOAD_NOT_CONFIGURED, UPSTREAM_ERROR, UPSTREAM_TIMEOUT, VALIDATION_ERROR, VERIFICATION_LINK_USED, VERIFICATION_TOKEN_EXPIRED, WEBHOOK_SUBSCRIPTION_EXISTS

Examples

Executable examples are hidden for this endpoint until copy-paste guidance is published.