Get order details
Retrieve detailed information about a specific order including line items and status.
HMAC Signature Verification (Optional)
For enhanced security, you can verify the authenticity of order data using HMAC signatures.
When enabled, the response includes an X-Signature header containing an HMAC-SHA256 signature
of the response body.
To verify:
- Extract the
X-Signatureheader from the response - Compute HMAC-SHA256 of the response body using your API secret key
- Compare the computed signature with the header value
Example verification (Node.js):
curl --request GET \
--url https://api.tybritelabs.com/v1/orders/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.tybritelabs.com/v1/orders/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.tybritelabs.com/v1/orders/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tybritelabs.com/v1/orders/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.tybritelabs.com/v1/orders/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.tybritelabs.com/v1/orders/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.tybritelabs.com/v1/orders/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"id": "880e8400-e29b-41d4-a716-446655440003",
"customer_id": "550e8400-e29b-41d4-a716-446655440000",
"order_status": "processing",
"payment_status": "paid",
"total_amount": 2004.99,
"items": [
{
"product_name": "Apple MacBook Pro",
"quantity": 2,
"unit_price": 1999,
"subtotal": 1999
}
],
"created_at": "2026-02-03T10:30:00Z",
"updated_at": "2026-02-03T10:35:00Z"
}{
"error": {
"code": "invalid_request",
"message": "Invalid request parameters",
"details": "The 'email' field is required"
}
}{
"error": {
"code": "unauthorized",
"message": "Missing or invalid Authorization header"
}
}{
"error": {
"code": "forbidden",
"message": "This operation requires a secret key. Publishable keys cover catalogue reads and the actions a shopper takes for themselves."
}
}{
"error": {
"code": "not_found",
"message": "Resource not found"
}
}{
"error": {
"code": "rate_limited",
"message": "Too many requests for this API key. Please slow down and try again shortly.",
"remaining": 0,
"reset": 1706198400
}
}{
"error": {
"code": "server_error",
"message": "An unexpected error occurred"
}
}Authorizations
API Key Authentication
Use your API key in the Authorization header:
Authorization: Bearer tybrite_sk_live_YOUR_KEY
Key Types:
Secret Keys (Server-Side Only):
- Format:
tybrite_sk_live_*(production) ortybrite_sk_test_*(sandbox) - Full read/write access to all endpoints
- ⚠️ NEVER expose in client-side code or public repositories
- Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations
Publishable Keys (Client-Safe):
- Format:
tybrite_pk_live_*(production) ortybrite_pk_test_*(sandbox) - Catalogue reads, plus the actions a shopper takes for themselves
- ✅ Safe for client-side JavaScript, mobile apps, and public code
- Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents
Endpoint-Specific Requirements:
- Authentication endpoints (
/v1/auth/*): Secret key required - Payment verification (
POST /v1/payments/verify): Secret key required - AI Recommendations (
POST /v1/recommendations): Secret key required - Semantic Search (
POST /v1/search): Both key types allowed (read-only operation) - Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
- All other write operations: Secret key required
- All read operations: Both key types allowed
Using a publishable key for restricted operations returns 403 Forbidden.
Path Parameters
Order UUID
Query Parameters
Comma-separated list of fields to include in the response.
Allowed Fields:
id,order_number,customer_id,customer_email,customer_phone,customer_namebilling_address,shipping_addresssubtotal,tax_amount,shipping_amount,discount_amount,total_amountpayment_method,payment_status,order_status,payment_referencenotes,tracking_number,estimated_deliveryshipped_at,delivered_atcreated_at,updated_atshipping_metadatafulfillment_method,pickup_location_id,fulfillment_location_id,shipping_option_iditems
Response
Successfully retrieved order
"ORD-2026-001234"
pending, confirmed, processing, shipped, delivered, cancelled "pending"
pending, paid, failed, refunded "pending"
Method used for payment
stripe, paypal, paystack, mpesa, cash, bank_transfer "stripe"
1999.98
159.99
Per-jurisdiction tax detail when tax was calculated automatically for the shipping destination (one entry per taxing jurisdiction). Null when a flat store rate was used.
Show child attributes
Show child attributes
How the tax figure was produced — automatic (jurisdiction-accurate calculation for the destination), fallback (automatic calculation was unavailable, so the store's configured rate was used), or manual (the store's configured rate).
automatic, fallback, manual, null "automatic"
15
0
2174.97
Show child attributes
Show child attributes
Where the order goes. On a pickup order it is the collection location's address, with type: pickup, the location's name and location_id, and the address in line1 / line2 / city / state / postal_code / country.
Show child attributes
Show child attributes
Whether the order is delivered to the shopper or collected at one of the store's locations.
delivery, pickup "delivery"
The location the shopper collects from, on a pickup order. Null on a delivery order.
null
The store location the order is fulfilled from: the pickup location on a pickup order, or the location deliveries leave from when the store delivers from its nearest location. Null when the store does not route orders between locations.
"7b2e9c41-0d3f-4a58-b6e1-2f4a6c8e0b13"
The shipping option the order was placed with, as returned by POST /v1/shipping/calculate (place, opt:<id> or pickup:<location id>). Null when none was named.
"place"
Show child attributes
Show child attributes
Customer-visible updates the merchant added as the order moved — the work between payment and dispatch (preparation, checks, packing) that a shopper otherwise hears nothing about. Oldest first, so it reads as a timeline. Internal notes are never included.
Show child attributes
Show child attributes
The merchant's own fields on this order, with their values — a buyer's purchase-order number, a cost centre, whatever the merchant defined. Only fields the merchant published appear here; one holding an internal note or a cost stays in the admin. Empty when the merchant has defined none.
The merchant controls the names and how many exist, so render the array rather than reading fixed
keys: field_label is the heading to show, and field_type gives the shape of value.
Show child attributes
Show child attributes
Whether this order was created in the live or test environment. Sandbox orders are isolated from production data.
production, sandbox "production"
How the shipping charge was arrived at. shipping_source and shipping_rule are recorded by the server when the order is created; the other fields are the details the storefront sent with the order.
Show child attributes
Show child attributes
curl --request GET \
--url https://api.tybritelabs.com/v1/orders/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.tybritelabs.com/v1/orders/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.tybritelabs.com/v1/orders/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tybritelabs.com/v1/orders/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.tybritelabs.com/v1/orders/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.tybritelabs.com/v1/orders/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.tybritelabs.com/v1/orders/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"id": "880e8400-e29b-41d4-a716-446655440003",
"customer_id": "550e8400-e29b-41d4-a716-446655440000",
"order_status": "processing",
"payment_status": "paid",
"total_amount": 2004.99,
"items": [
{
"product_name": "Apple MacBook Pro",
"quantity": 2,
"unit_price": 1999,
"subtotal": 1999
}
],
"created_at": "2026-02-03T10:30:00Z",
"updated_at": "2026-02-03T10:35:00Z"
}{
"error": {
"code": "invalid_request",
"message": "Invalid request parameters",
"details": "The 'email' field is required"
}
}{
"error": {
"code": "unauthorized",
"message": "Missing or invalid Authorization header"
}
}{
"error": {
"code": "forbidden",
"message": "This operation requires a secret key. Publishable keys cover catalogue reads and the actions a shopper takes for themselves."
}
}{
"error": {
"code": "not_found",
"message": "Resource not found"
}
}{
"error": {
"code": "rate_limited",
"message": "Too many requests for this API key. Please slow down and try again shortly.",
"remaining": 0,
"reset": 1706198400
}
}{
"error": {
"code": "server_error",
"message": "An unexpected error occurred"
}
}
