Order Management API Examples

This guide shows how to call the Order Management APIs on behalf of an authorized merchant using the user_grant token obtained from the Authorization Flow.

Authentication

All requests only need one header:

Authorization: Bearer <user_grant_token>

You do not need the signature-based headers used by the traditional OpenAPI model. Do not send:

• Credential
• Signature
• Nonce

The gateway validates the token, resolves the merchant, and enforces your App scopes automatically — each token is already bound to one merchant.

info

Base URL: https://api-stg.wonder.app (UAT) / https://api.wonder.app (Production). Examples below use UAT.

Create an Order

curl -X POST 'https://api-stg.wonder.app/svc/payment/api/v1/openapi/orders' \
  -H 'Authorization: Bearer {{USER_GRANT_TOKEN}}' \
  -H 'Content-Type: application/json' \
  -d '{
    "order": {
      "charge_fee": "10.00",
      "currency": "HKD",
      "reference_number": "POS-20261109-0001",
      "note": "Lunch order",
      "due_date": "2026-11-09 23:59:59",
      "line_items": [
        {
          "label": "Margherita Pizza",
          "price": "10.00",
          "quantity": 1,
          "total": "10.00"
        }
      ]
    }
  }'

Get an Order

curl -X POST 'https://api-stg.wonder.app/svc/payment/api/v1/openapi/orders/check' \
  -H 'Authorization: Bearer {{USER_GRANT_TOKEN}}' \
  -H 'Content-Type: application/json' \
  -d '{
    "order": {
      "number": "{{ORDER_NUMBER}}"
    }
  }'

List Orders

curl 'https://api-stg.wonder.app/svc/payment/api/v1/openapi/orders/list?offset=0&limit=20&filter=state:completed' \
  -H 'Authorization: Bearer {{USER_GRANT_TOKEN}}'

Void an Order

curl -X POST 'https://api-stg.wonder.app/svc/payment/api/v1/openapi/orders/void' \
  -H 'Authorization: Bearer {{USER_GRANT_TOKEN}}' \
  -H 'Content-Type: application/json' \
  -d '{
    "order": {
      "number": "{{ORDER_NUMBER}}"
    }
  }'

Void a Transaction

curl -X POST 'https://api-stg.wonder.app/svc/payment/api/v1/openapi/transactions/void' \
  -H 'Authorization: Bearer {{USER_GRANT_TOKEN}}' \
  -H 'Content-Type: application/json' \
  -d '{
    "order": {
      "number": "{{ORDER_NUMBER}}"
    },
    "transaction": {
      "uuid": "{{TRANSACTION_UUID}}"
    }
  }'

Refund a Transaction

curl -X POST 'https://api-stg.wonder.app/svc/payment/api/v1/openapi/orders/refund' \
  -H 'Authorization: Bearer {{USER_GRANT_TOKEN}}' \
  -H 'Content-Type: application/json' \
  -d '{
    "order": {
      "number": "{{ORDER_NUMBER}}"
    },
    "transaction": {
      "uuid": "{{TRANSACTION_UUID}}"
    },
    "refund": {
      "amount": "5.00",
      "note": "partial refund"
    }
  }'

Capture a Transaction

For pre-authorized payments (is_only_pre_auth orders), capture the amount to complete the payment:

curl -X POST 'https://api-stg.wonder.app/svc/payment/api/v1/openapi/orders/capture' \
  -H 'Authorization: Bearer {{USER_GRANT_TOKEN}}' \
  -H 'Content-Type: application/json' \
  -d '{
    "order": {
      "number": "{{ORDER_NUMBER}}"
    },
    "transaction": {
      "uuid": "{{TRANSACTION_UUID}}"
    },
    "capture": {
      "amount": "10.00",
      "close_order": true
    }
  }'

Token Expired

When the token expires, the API returns 401 Unauthorized. Refresh it with the refresh_token (see Step 6: Refreshing Tokens) and retry the request — no merchant interaction needed.