Orders

List orders

GET
/api/v1/orders

List the studio's orders, filtered and paginated.

Authorization

ApiKeyAuth orders:read
headerAuthorizationBearer <shyni_sk_live_*>

An API key, issued once and never retrievable again: an organization key in the developer portal, or a studio key in the studio's admin (Moje studio → API). Send as Authorization: Bearer shyni_sk_live_....

Scope: orders:read

Query Parameters

state?string

Filter to a single order state.

Value in"CREATED""CONFIRMED""IN_PROGRESS""DONE""CANCELLED"
depositState?string

Filter to a single deposit state.

Value in"PENDING""PAID""REFUNDED""NOT_REQUIRED"
fromDate?string

Inclusive lower bound on the order's scheduled date (YYYY-MM-DD).

Formatdate
toDate?string

Inclusive upper bound on the order's scheduled date (YYYY-MM-DD).

Formatdate
search?string

Free-text match (customer name, phone, plate, order number, mirrors the admin order search).

customerEmail?string

Filter to a single customer email (exact match).

Formatemail
sourceChannel?string

Filter to orders that came from one channel.

Value in"STOREFRONT""EMBED""QR""BOOKING_LINK""RETURN_REMINDER""ADMIN""API"
sourceLabel?string

Filter to orders with this source label (sanitized like the stored one, exact match).

externalRef?string

Filter to the order that carries this externalRef (exact match; at most one, as it is unique per studio).

updatedSince?string

Only orders whose updatedAt is strictly after this ISO-8601 instant (e.g. 2026-10-01T08:00:00Z); anything else answers 400 INVALID_INPUT with field: updatedSince. Pair it with sortBy=updatedAt to catch up on what you missed.

Formatdate-time
sortBy?string

What the list is ordered by (direction by sort); equal values are ordered by id, so paging is stable.

Default"scheduledStart"
Value in"scheduledStart""updatedAt"
page?integer
Range1 <= value
Default1
perPage?integer
Range1 <= value <= 100
Default20
sort?string

Sort direction on scheduled start.

Default"asc"
Value in"asc""desc"

Response Body

A page of orders.

application/json
  1. response
data*array<>
meta*
Example Request
curl -X GET 'https://api.shyni.io/api/v1/orders' \  -H 'Authorization: Bearer shyni_sk_test_YOUR_KEY'

Response 200

A page of orders.

{  "data": [    {      "id": "string",      "publicId": "string",      "state": "CREATED",      "kind": "ORDER",      "depositState": "PENDING",      "currency": "string",      "depositAmount": 0,      "depositPaidAt": "2019-08-24T14:15:22Z",      "scheduledStart": "2019-08-24T14:15:22Z",      "scheduledEnd": "2019-08-24T14:15:22Z",      "pickupAt": "2019-08-24T14:15:22Z",      "createdAt": "2019-08-24T14:15:22Z",      "updatedAt": "2019-08-24T14:15:22Z",      "externalRef": "string",      "readyAt": "2019-08-24T14:15:22Z",      "customer": {        "id": "string",        "name": "string",        "email": "user@example.com",        "phone": "string",        "externalRef": "string"      },      "variant": "string",      "subject": {        "id": "string",        "type": "string",        "attributes": {          "property1": "string",          "property2": "string"        },        "summary": "string",        "externalRef": "string"      },      "serviceLines": [        {          "id": "string",          "name": "string",          "price": 0,          "durationMinutes": 0,          "packageHead": true,          "custom": true,          "serviceId": "string",          "packageId": "string",          "optionAnswers": [            {              "questionId": "string",              "optionId": "string"            }          ]        }      ],      "totalPrice": 0,      "paidTotal": 0,      "balanceDue": 0,      "payments": [        {          "id": "string",          "amount": 0,          "method": "string",          "recordedAt": "2019-08-24T14:15:22Z",          "reference": "string"        }      ],      "appliedDiscountCode": {        "code": "string",        "type": "string",        "discount": 0      },      "note": "string",      "cancellationReason": "string",      "sourceChannel": "STOREFRONT",      "sourceLabel": "string",      "utmSource": "string",      "utmMedium": "string",      "utmCampaign": "string",      "referrerDomain": "string",      "attribution": {        "utmSource": "string",        "utmMedium": "string",        "utmCampaign": "string",        "utmTerm": "string",        "utmContent": "string",        "referrer": "string",        "gclid": "string",        "gbraid": "string",        "wbraid": "string",        "fbclid": "string"      },      "metadata": {        "property1": "string",        "property2": "string"      },      "billing": {        "company": "string",        "ico": "string",        "dic": "string",        "address": "string"      },      "cancelledBy": "STUDIO",      "assignedWorkerId": "string",      "acceptedTermsVersion": 0,      "waivedDayAdjustment": 0,      "pendingReschedule": {        "id": "string",        "requestedStart": "2019-08-24T14:15:22Z",        "requestedEnd": "2019-08-24T14:15:22Z",        "createdAt": "2019-08-24T14:15:22Z"      },      "rejectedReschedule": {        "id": "string",        "requestedStart": "2019-08-24T14:15:22Z",        "requestedEnd": "2019-08-24T14:15:22Z",        "reason": "string",        "rejectedAt": "2019-08-24T14:15:22Z"      },      "inspection": {        "reply": "COME",        "text": "string",        "repliedAt": "2019-08-24T14:15:22Z"      }    }  ],  "meta": {    "page": 0,    "perPage": 0,    "total": 0  }}

Response 400

A parameter, header or request body is missing, malformed, or out of range. A request body property the endpoint does not define answers UNKNOWN_FIELD instead, with field naming it.

{  "code": "INVALID_INPUT",  "message": "Parameter perPage must be between 1 and 100."}

Response 401

Missing, malformed, unknown, or revoked API key (INVALID_API_KEY).

{  "code": "INVALID_API_KEY",  "message": "Missing or invalid API key."}

Response 403

The key is valid but the request is refused. Branch on code: INSUFFICIENT_SCOPE (the key lacks the permission this endpoint requires), PLAN_REQUIRED (the studio is not on a plan that includes API keys, Pro and above), ORIGIN_NOT_ALLOWED, SECRET_KEY_IN_BROWSER, or DEMO_STUDIO on a write to the demo studio. See Authentication and Scopes above.

{  "code": "INSUFFICIENT_SCOPE",  "message": "This API key does not have the permission this endpoint requires."}

Response 429

Burst rate limit exceeded.

{  "code": "RATE_LIMITED",  "message": "Too many requests. Retry after the time given in the Retry-After header."}