GET /api/orders/ — Retrieve User or Admin Orders

Urban Store provides three read endpoints for orders. Each one calls check_and_cancel_expired_orders() before returning data, which scans for any pending orders whose expires_at has passed, cancels them, and restores their stock — so the data you receive is always up-to-date without requiring a separate background task.

GET /api/orders/my-orders/

Returns all orders belonging to the authenticated user, newest first.

Authentication

Bearer token required. Returns 401 if missing or invalid.

Response — 200 OK

An array of order objects (see full field reference below). Returns an empty array [] if the user has no orders.

Example

curl -X GET https://api.urbanstore.co/api/orders/my-orders/ \
  -H "Authorization: Bearer <token>"

[
  {
    "id": "664f1a2b3c4d5e6f7a8b9c0d",
    "order_number": "ORD-20240522153045-472",
    "user_id": "cliente@ejemplo.com",
    "items": [
      {
        "product_slug": "urban-cargo-pants",
        "product_name": "Urban Cargo Pants",
        "quantity": 1,
        "size": "M",
        "color": "Negro",
        "price_paid": 189000,
        "subtotal": 189000
      }
    ],
    "subtotal": 189000,
    "tax": 0,
    "shipping": 0,
    "total": 189000,
    "status": "pending",
    "shipping_address": {
      "email": "cliente@ejemplo.com",
      "name": "Juan Pérez",
      "phone": "3001234567",
      "address": "Calle 80 # 45-12 Apto 301",
      "city": "Bogotá",
      "department": "Cundinamarca",
      "country": "Colombia"
    },
    "notes": "",
    "created_at": "2024-05-22T15:30:45.123456+00:00",
    "expires_at": "2024-05-22T15:35:45.123456+00:00",
    "paid_at": null
  }
]

GET /api/orders/all/

Returns every order in the system, newest first. Restricted to admin users.

Authentication

Bearer token required with is_admin: true in the JWT payload. Returns 403 if the user is not an admin.

Response — 200 OK

An array of all order objects across all users.

Example

curl -X GET https://api.urbanstore.co/api/orders/all/ \
  -H "Authorization: Bearer <admin_token>"

GET /api/orders//

Returns the full detail of a single order identified by its MongoDB ObjectId.

Authentication

Bearer token required. Regular users can only fetch their own orders — the server filters by both id and user_id. Admin users can retrieve any order.

Path Parameter

order_id

string

required

The MongoDB ObjectId of the order (24-character hex string).

Response — 200 OK

string

MongoDB ObjectId of the order (string representation).

order_number

string

Human-readable order reference in the format ORD-<timestamp>-<random>, e.g. ORD-20240522153045-472.

user_id

string

Email address of the user who placed the order.

items

array

Array of line-item objects. Each contains: product_slug, product_name, quantity, size, color, price_paid, subtotal.

subtotal

number

Sum of all item subtotals in COP, before tax and shipping.

tax

number

Tax amount in COP. Defaults to 0.

shipping

number

Shipping cost in COP. Defaults to 0.

total

number

Final amount charged (subtotal + tax + shipping) in COP.

status

string

Current order lifecycle state. One of: pending, paid, pending_shipment, shipped, cancelled.

shipping_address

object

Embedded object with: email, name, phone, address, city, department, country.

notes

string

Freetext delivery notes provided at checkout. Empty string if none.

created_at

string

ISO 8601 timestamp of when the order was created.

expires_at

string | null

ISO 8601 timestamp after which an unpaid pending order is auto-cancelled. null once the order has been paid.

paid_at

string | null

ISO 8601 timestamp of when payment was confirmed. null if not yet paid.

Example

curl -X GET https://api.urbanstore.co/api/orders/664f1a2b3c4d5e6f7a8b9c0d/ \
  -H "Authorization: Bearer <token>"

{
  "id": "664f1a2b3c4d5e6f7a8b9c0d",
  "order_number": "ORD-20240522153045-472",
  "user_id": "cliente@ejemplo.com",
  "items": [
    {
      "product_slug": "urban-cargo-pants",
      "product_name": "Urban Cargo Pants",
      "quantity": 1,
      "size": "M",
      "color": "Negro",
      "price_paid": 189000,
      "subtotal": 189000
    }
  ],
  "subtotal": 189000,
  "tax": 0,
  "shipping": 0,
  "total": 189000,
  "status": "pending",
  "shipping_address": {
    "email": "cliente@ejemplo.com",
    "name": "Juan Pérez",
    "phone": "3001234567",
    "address": "Calle 80 # 45-12 Apto 301",
    "city": "Bogotá",
    "department": "Cundinamarca",
    "country": "Colombia"
  },
  "notes": "",
  "created_at": "2024-05-22T15:30:45.123456+00:00",
  "expires_at": "2024-05-22T15:35:45.123456+00:00",
  "paid_at": null
}

Error Responses

Status	Condition
`401 Unauthorized`	Token missing, malformed, or expired
`403 Forbidden`	Admin-only endpoint accessed by a regular user (`/all/`)
`404 Not Found`	Order ID does not exist, or belongs to a different user

Users

Products & Cart

Orders & Payments

Analytics

GET /api/orders/ — Retrieve User or Admin Orders

GET /api/orders/my-orders/

Authentication

Response — 200 OK

Example

GET /api/orders/all/

Authentication

Response — 200 OK

Example

GET /api/orders//

Authentication

Path Parameter

Response — 200 OK

Example

Error Responses

Build docs developers (and LLMs) love

Users

Products & Cart

Orders & Payments

Analytics

Documentation Index

​GET /api/orders/my-orders/

​Authentication

​Response — 200 OK

​Example

​GET /api/orders/all/

​Authentication

​Response — 200 OK

​Example

​GET /api/orders//

​Authentication

​Path Parameter

​Response — 200 OK

​Example

​Error Responses

Build docs developers (and LLMs) love

GET /api/orders/my-orders/

Authentication

Response — 200 OK

Example

GET /api/orders/all/

Authentication

Response — 200 OK

Example

GET /api/orders//

Authentication

Path Parameter

Response — 200 OK

Example

Error Responses