List orders | Ziba Pay Developer Documentation

GET/payment/zibapay/orders/allAPI

Authentication:Bearer token•Authorization: Bearer <token>(Bearer token for server-to-server API calls)

Security requirement: 403 CSRF Protection

Direct server-to-server calls authenticated via Bearer tokens do not require CSRF headers. If you instead invoke mutation endpoints from a web browser using cookie-based sessions, you must include the following header:

X-Requested-With: XMLHttpRequest

import axios from "axios";

const url = "https://payment-service-mh2d.onrender.com/api/payment/zibapay/orders/all";

const headers = {
    Authorization: `Bearer ${process.env.ZIBA_TOKEN}`,
};

try {
  const response = await axios.get(url, {
    headers,
    timeout: 15000,
  });
  console.log("Success:", response.status, response.data);
} catch (error) {
  console.error("Request failed:", error.response?.data || error.message);
}

Auth guide

Response fields

Field	Type	Presence	Description
`[].orderId`	string	Always returned	Order reference ID.
`[].amount`	number	Always returned	Order monetary amount.
`[].currency`	string	Always returned	Currency code (NGN, RWF, GHS, USD).
`[].description`	string	Always returned	Order description.
`[].status`	string	Always returned	Current order status (PENDING, COMPLETED, FAILED, REVERSED).
`[].createdAt`	string	Always returned	Order creation timestamp.

Status codes

HTTP Status	Meaning
200	Merchant orders list.
401	No merchant session.

Notes

HTTP 200 returns the orders loaded for that merchant. This route does not take page or limit query parameters.

GET/payment/zibapay/orders/allAPI

Authentication:Bearer token•Authorization: Bearer <token>(Bearer token for server-to-server API calls)

Security requirement: 403 CSRF Protection

Auth guide →

X-Requested-With: XMLHttpRequest

import axios from "axios";

const url = "https://payment-service-mh2d.onrender.com/api/payment/zibapay/orders/all";

const headers = {
    Authorization: `Bearer ${process.env.ZIBA_TOKEN}`,
};

try {
  const response = await axios.get(url, {
    headers,
    timeout: 15000,
  });
  console.log("Success:", response.status, response.data);
} catch (error) {
  console.error("Request failed:", error.response?.data || error.message);
}

Auth guide

Response fields

Field	Type	Presence	Description
`[].orderId`	string	Always returned	Order reference ID.
`[].amount`	number	Always returned	Order monetary amount.
`[].currency`	string	Always returned	Currency code (NGN, RWF, GHS, USD).
`[].description`	string	Always returned	Order description.
`[].status`	string	Always returned	Current order status (PENDING, COMPLETED, FAILED, REVERSED).
`[].createdAt`	string	Always returned	Order creation timestamp.

Status codes

HTTP Status	Meaning
200	Merchant orders list.
401	No merchant session.

Notes

HTTP 200 returns the orders loaded for that merchant. This route does not take page or limit query parameters.