Query Order Status

API Overview

Returns the full status event history for a single parcel identified by its WMG tracking number. The response includes delivery activities, carrier tracking information, signed-by name, and proof-of-delivery references.

Request Information

• Method: GET
• Path: /openapi/order/query-status
• Authentication: Standard OpenAPI token (MD5-based)

Request Headers

Field	Description
Content-Type	application/json
x-auth-name	$API_NAME
x-auth-seed	$SEED (13-digit millisecond Unix timestamp)
x-auth-token	$TOKEN (MD5 hash)

Request Parameters

Parameter	Type	Required	Description
tracking_num	string	Yes	WMG parcel tracking number

Token Generation Example

The authentication token is computed from your credentials and seed only -- request parameters are not included.

seed  = "1746700000000"   (13-digit ms timestamp)
token = md5( strtolower(api_name) + api_key + seed )

Authentication

This endpoint uses Standard OpenAPI Authentication (MD5 token).

For complete authentication instructions and code examples, see Authentication Guide.

Response Information

The response is in JSON format.

Response Format

Field	Type	Description
code	integer	Result code. 0 = success, 1 = failure
message	string	Result description
data	object	Response payload

Success Response

• Status Code: 200
• Response Body:

{
  "code": 0,
  "message": "success",
  "data": {
    "tracking_number": "CW900000019VN",
    "last_status": "FD_BA",
    "last_status_date_time": "2025-01-10T13:52:59+08:00",
    "activities": [
      {
        "status_date_time": "2025-01-10T13:52:59+08:00",
        "status_code": "FD_BA",
        "status_desc": "Parcel has a bad recipient address",
        "remarks": "",
        "receive_by": "",
        "pod": [
          "https://xxxxxxx/pod/08d34130-5178-471f-8c91-dc63087d90ff",
          "https://xxxxxx/pod/5d0d5d54-74bc-40bf-99fc-356a302482b8"
        ],
        "location": "VN"
      },
      {
        "status_date_time": "2025-01-08T16:01:51+08:00",
        "status_code": "DR_DR",
        "status_desc": "Data Received via API",
        "remarks": "",
        "receive_by": "",
        "pod": [],
        "location": "VN"
      }
    ],
    "partner_tracking_no": "",
    "partner_name": ""
  }
}

Field	Type	Description
data.tracking_number	string	WMG tracking number
data.last_status	string	Most recent status code
data.last_status_date_time	string	ISO 8601 timestamp of the most recent status event
data.activities	array	Ordered list of all status events
data.activities[].status_date_time	string	ISO 8601 timestamp of this event
data.activities[].status_code	string	Status code for this event
data.activities[].status_desc	string	Human-readable status description
data.activities[].remarks	string	Additional remarks for this event
data.activities[].receive_by	string	Name of the person who signed for the parcel; empty for non-delivery events
data.activities[].pod	array	Proof-of-delivery file references; empty if not applicable
data.activities[].location	string	Location or country code where the event occurred
data.partner_tracking_no	string	Carrier-assigned tracking number
data.partner_name	string	Name of the assigned carrier

When the tracking number is not found under this client, the response is code: 1 and data carries the tracking number together with a remarks field:

{
    "code": 1,
    "message": "fail",
    "data": {
        "tracking_number": "240304101132642048443a",
        "remarks": "No Record(s)"
    }
}

Error Response

• Status Code: 200 (business logic error) or 4xx/5xx (system error)
• Response Body:

{
  "code": 1,
  "message": "x-auth-token: INVALID",
  "data": []
}

Common errors:

• Authentication failure → code 1; the message depends on the cause (e.g. x-auth-token: INVALID, x-auth-seed: TIMEOUT) — see signature.md
• Tracking number not found → code 1, message fail, with data.remarks set to No Record(s)

Code Reference

Code	Description
0	Success
1	Failure

Example

Bash

API_NAME="your_api_name"
API_KEY="your_api_key"
SEED=$(date +%s%3N)
TOKEN=$(printf '%s' "$(echo -n "$API_NAME" | tr '[:upper:]' '[:lower:]')${API_KEY}${SEED}" | md5sum | cut -d' ' -f1)

curl -G "https://api.test.wmgdelivery.com/v1/openapi/order/query-status" \
  --data-urlencode "tracking_num=WMG1234567" \
  -H "x-auth-name: $API_NAME" \
  -H "x-auth-seed: $SEED" \
  -H "x-auth-token: $TOKEN"

Windows PowerShell

$API_NAME = "your_api_name"
$API_KEY  = "your_api_key"
$SEED     = [string]([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds())

$raw   = [System.Text.Encoding]::UTF8.GetBytes($API_NAME.ToLower() + $API_KEY + $SEED)
$md5   = [System.Security.Cryptography.MD5]::Create().ComputeHash($raw)
$TOKEN = -join ($md5 | ForEach-Object { $_.ToString("x2") })

$headers = @{
    "x-auth-name"  = $API_NAME
    "x-auth-seed"  = $SEED
    "x-auth-token" = $TOKEN
}

$response = Invoke-RestMethod `
    -Uri "https://api.test.wmgdelivery.com/v1/openapi/order/query-status?tracking_num=WMG1234567" `
    -Method Get -Headers $headers
$response | ConvertTo-Json -Depth 10

Python

import hashlib, time
import requests

API_NAME = 'your_api_name'
API_KEY  = 'your_api_key'
SEED     = str(int(time.time() * 1000))
TOKEN    = hashlib.md5((API_NAME.lower() + API_KEY + SEED).encode()).hexdigest()

headers = {
    'x-auth-name':  API_NAME,
    'x-auth-seed':  SEED,
    'x-auth-token': TOKEN,
}

resp = requests.get(
    'https://api.test.wmgdelivery.com/v1/openapi/order/query-status',
    params={'tracking_num': 'WMG1234567'},
    headers=headers,
)
print(resp.json())

Node.js / TypeScript

import crypto from 'node:crypto';

const API_NAME = 'your_api_name';
const API_KEY  = 'your_api_key';
const SEED     = String(Date.now());
const TOKEN    = crypto.createHash('md5').update(API_NAME.toLowerCase() + API_KEY + SEED).digest('hex');

const url = new URL('https://api.test.wmgdelivery.com/v1/openapi/order/query-status');
url.searchParams.set('tracking_num', 'WMG1234567');

const resp = await fetch(url.toString(), {
    headers: {
        'x-auth-name':  API_NAME,
        'x-auth-seed':  SEED,
        'x-auth-token': TOKEN,
    },
});
console.log(JSON.stringify(await resp.json(), null, 2));

PHP

<?php
$API_NAME = 'your_api_name';
$API_KEY  = 'your_api_key';
$SEED     = (string)(time() * 1000);
$TOKEN    = md5(strtolower($API_NAME) . $API_KEY . $SEED);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.test.wmgdelivery.com/v1/openapi/order/query-status?' . http_build_query(['tracking_num' => 'WMG1234567']));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'x-auth-name: '  . $API_NAME,
    'x-auth-seed: '  . $SEED,
    'x-auth-token: ' . $TOKEN,
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
curl_close($ch);
echo json_encode(json_decode($response, true), JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE) . "\n";
?>

Notes

• When the tracking number has no records, the response code is 0 but data.remarks contains No Record(s).
• The authentication token does not include request parameters; only credentials and seed are used.
• The seed must be a 13-digit millisecond Unix timestamp and within ±10 minutes of server time.
• All parameters are case-sensitive.

Error Codes

code	message	Description
1	Authentication error message	Authentication failed; the returned message depends on the cause — see the full list in signature.md
1	fail (with data.remarks = "No Record(s)")	Tracking number not found under this client; the carrier-routed fallback path may also return a carrier-provided remark string