List Sales Orders
GET/api/sales-orders/list
Paginated sales order listing for the list view (Spatie QueryBuilder).
orders:readGrant this scope to your token under Settings → Developer → Personal Access Tokens.
Each row includes ship_by_date (the ship-by deadline / ceiling), deliver_by_date, and hold_until_date (the earliest date the order may ship — a release floor used for preorders / held orders). Held orders also expose opens_at and hold_reason when reserved via a Shopify channel.
The response is standard Laravel pagination with an extra top-level unfiltered_total (total count ignoring filters).
Authentication: Requires Bearer token. Scope: orders (read).
Filtering (API integrations — start here): use flat filter[...] params. Any listed column works as filter[<column>]=<value> (implicit is) or filter[<column>.<operator>]=<value> for an explicit operator; e.g. filter[to_fulfill_warehouse_id]=1, filter[order_status.is]=open, filter[total.greater_than]=100, filter[order_date.between]=2026-04-01,2026-04-30. Multiple flat filters AND together, and .is_one_of/.between take a comma-separated value. These params are individually documented (see the disabled query params below). The filter_groups param is a base64 JSON tree used by the web UI's Advanced Filters and is only needed for OR / nested groups — avoid it for API use.
Related-record id filters (for support/debugging — trace a sales order by any id in the fulfillment chain): filter[sales_order_line_id] (SOL), filter[fulfillment_order_id] (FO), filter[fulfillment_order_line_id] (FOL), filter[sales_order_fulfillment_id] (SOF), filter[sales_order_fulfillment_line_id] (SOFL). All numeric, optional, and support operators (.is_one_of, etc.) plus comma-separated multi-match.
Request
Responses
- 200
- 401
- 403
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.