Query Multiple Order Status

API Overview

Returns status event history for multiple parcels in a single request. Results are split into success (tracking numbers found) and errors (not found or invalid). Use this endpoint for bulk status reconciliation.

Request Information

• Method: POST
• Path: /openapi/order/query-multi-status
• Authentication: Standard OpenAPI token (MD5-based)

Request Headers

Field	Description
Content-Type	application/json
x-auth-name	$API_NAME
x-auth-seed	$SEED (13-digit millisecond Unix timestamp)
x-auth-token	$TOKEN (MD5 hash)

Request Parameters

Parameter	Type	Required	Description
tracking_nums	array	Yes	Array of WMG tracking number strings

Request Body Example

{
  "tracking_nums": ["WMG1234567", "WMG7654321", "WMG9999999"]
}

Token Generation Example

The authentication token is computed from your credentials and seed only -- request parameters are not included.

seed  = "1746700000000"   (13-digit ms timestamp)
token = md5( strtolower(api_name) + api_key + seed )

Authentication

This endpoint uses Standard OpenAPI Authentication (MD5 token).

For complete authentication instructions and code examples, see Authentication Guide.

Response Information

The response is in JSON format.

Response Format

Field	Type	Description
code	integer	Result code. 0 = success, 1 = failure
message	string	Result description
data	object	Contains success and errors arrays

Success Response

• Status Code: 200
• Response Body:

{
  "code": 0,
  "message": "success",
  "data": {
    "success": [
      {
        "tracking_number": "CW900000019VN",
        "last_status": "FD_BA",
        "last_status_date_time": "2025-01-10T13:52:59+08:00",
        "activities": [
          {
            "status_date_time": "2025-01-10T13:52:59+08:00",
            "status_code": "FD_BA",
            "status_desc": "Parcel has a bad recipient address",
            "remarks": "",
            "receive_by": "",
            "pod": [
              "https://xxxxxx/pod/08d34130-5178-471f-8c91-dc63087d90ff",
              "https://xxxxxxx/pod/5d0d5d54-74bc-40bf-99fc-356a302482b8"
            ],
            "location": "VN"
          },
          {
            "status_date_time": "2025-01-08T16:01:51+08:00",
            "status_code": "DR_DR",
            "status_desc": "Data Received via API",
            "remarks": "",
            "receive_by": "",
            "pod": [],
            "location": "VN"
          }
        ],
        "partner_tracking_no": "",
        "partner_name": ""
      }
    ],
    "errors": [
      {
        "tracking_number": "240304101132555047718",
        "remarks": "No Record(s)"
      },
      {
        "tracking_number": "C240719112805AF011",
        "remarks": "No Record(s)"
      },
      {
        "tracking_number": "WGC000000000051",
        "remarks": "No Record(s)"
      }
    ]
  }
}

Field	Type	Description
data.success	array	Orders for which status records were found. Each element has the same structure as the Query Order Status response
data.errors	array	Tracking numbers for which no records were found
data.errors[].tracking_number	string	The tracking number that was not found
data.errors[].remarks	string	Reason (e.g., No Record(s))

Error Response

• Status Code: 200 (business logic error) or 4xx/5xx (system error)
• Response Body:

{
  "code": 1,
  "message": "x-auth-token: INVALID",
  "data": []
}

Common errors:

• Authentication failure → code 1; the message depends on the cause (e.g. x-auth-token: INVALID, x-auth-seed: TIMEOUT) — see signature.md

Always send tracking_nums as an array. An empty array returns code: 0 with both success and errors empty; omitting the field entirely, or sending a string instead of an array, comes back as the generic system error (code: 1, message something error) — this endpoint has no per-field checks, so nothing more specific is returned.

Code Reference

Code	Description
0	Success
1	Failure

Example

Bash

API_NAME="your_api_name"
API_KEY="your_api_key"
SEED=$(date +%s%3N)
TOKEN=$(printf '%s' "$(echo -n "$API_NAME" | tr '[:upper:]' '[:lower:]')${API_KEY}${SEED}" | md5sum | cut -d' ' -f1)

curl -X POST "https://api.test.wmgdelivery.com/v1/openapi/order/query-multi-status" \
  -H "Content-Type: application/json" \
  -H "x-auth-name: $API_NAME" \
  -H "x-auth-seed: $SEED" \
  -H "x-auth-token: $TOKEN" \
  -d '{"tracking_nums": ["WMG1234567", "WMG7654321", "WMG9999999"]}'

Windows PowerShell

$API_NAME = "your_api_name"
$API_KEY  = "your_api_key"
$SEED     = [string]([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds())

$raw   = [System.Text.Encoding]::UTF8.GetBytes($API_NAME.ToLower() + $API_KEY + $SEED)
$md5   = [System.Security.Cryptography.MD5]::Create().ComputeHash($raw)
$TOKEN = -join ($md5 | ForEach-Object { $_.ToString("x2") })

$body = @{
    tracking_nums = @("WMG1234567", "WMG7654321", "WMG9999999")
} | ConvertTo-Json -Compress

$headers = @{
    "Content-Type" = "application/json"
    "x-auth-name"  = $API_NAME
    "x-auth-seed"  = $SEED
    "x-auth-token" = $TOKEN
}

$response = Invoke-RestMethod `
    -Uri "https://api.test.wmgdelivery.com/v1/openapi/order/query-multi-status" `
    -Method Post -Headers $headers -Body $body
$response | ConvertTo-Json -Depth 10

Python

import hashlib, time
import requests

API_NAME = 'your_api_name'
API_KEY  = 'your_api_key'
SEED     = str(int(time.time() * 1000))
TOKEN    = hashlib.md5((API_NAME.lower() + API_KEY + SEED).encode()).hexdigest()

headers = {
    'Content-Type': 'application/json',
    'x-auth-name':  API_NAME,
    'x-auth-seed':  SEED,
    'x-auth-token': TOKEN,
}

body = {
    'tracking_nums': ['WMG1234567', 'WMG7654321', 'WMG9999999'],
}

resp = requests.post('https://api.test.wmgdelivery.com/v1/openapi/order/query-multi-status', json=body, headers=headers)
print(resp.json())

Node.js / TypeScript

import crypto from 'node:crypto';

const API_NAME = 'your_api_name';
const API_KEY  = 'your_api_key';
const SEED     = String(Date.now());
const TOKEN    = crypto.createHash('md5').update(API_NAME.toLowerCase() + API_KEY + SEED).digest('hex');

const body = JSON.stringify({
    tracking_nums: ['WMG1234567', 'WMG7654321', 'WMG9999999'],
});

const resp = await fetch('https://api.test.wmgdelivery.com/v1/openapi/order/query-multi-status', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'x-auth-name':  API_NAME,
        'x-auth-seed':  SEED,
        'x-auth-token': TOKEN,
    },
    body,
});
console.log(JSON.stringify(await resp.json(), null, 2));

PHP

<?php
$API_NAME = 'your_api_name';
$API_KEY  = 'your_api_key';
$SEED     = (string)(time() * 1000);
$TOKEN    = md5(strtolower($API_NAME) . $API_KEY . $SEED);

$body = [
    'tracking_nums' => ['WMG1234567', 'WMG7654321', 'WMG9999999'],
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.test.wmgdelivery.com/v1/openapi/order/query-multi-status');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body, JSON_UNESCAPED_UNICODE));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'x-auth-name: '  . $API_NAME,
    'x-auth-seed: '  . $SEED,
    'x-auth-token: ' . $TOKEN,
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 15);
$response = curl_exec($ch);
curl_close($ch);
echo json_encode(json_decode($response, true), JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE) . "\n";
?>

Notes

• Tracking numbers not found are returned in data.errors, not as a top-level error code.
• The authentication token does not include request parameters; only credentials and seed are used.
• The seed must be a 13-digit millisecond Unix timestamp and within ±10 minutes of server time.
• All parameters are case-sensitive.

Error Codes

code	message	Description
1	Authentication error message	Authentication failed; the returned message depends on the cause — see the full list in signature.md