Look up an order and its transactions

curl -X GET "https://test-api.kashier.io/v3/payment/orders?search=ORDER-12345&startDate=2026-06-01&endDate=2026-06-18"

{  "status": "SUCCESS",  "message": "Orders retrieved successfully",  "data": [    {      "merchantOrderId": "ORDER-12345",      "orderId": "00916dc7-7a3a-4875-af44-118bc678378b",      "status": "CAPTURED",      "interChangeRate": "ON_US",      "transactions": [        {          "operation": "3dsecure_verify",          "status": "SUCCESS",          "transactionResponseCode": "AUTHENTICATION_IN_PROGRESS",          "transactionResponseMessage": {            "en": "Authentication in progress",            "ar": "المصادقة قيد التقدم"          },          "reconcilation": "NA",          "merchantWebhookReconciliation": "NA"        },        {          "operation": "pay",          "status": "SUCCESS",          "transactionResponseCode": "APPROVED",          "transactionResponseMessage": {            "en": "Approved",            "ar": "تمت الموافقة"          },          "reconcilation": "OK",          "merchantWebhookReconciliation": "OK",          "isSettled": true        }      ]    }  ],  "pagination": {    "total": 1,    "page": 1,    "limit": 20,    "pages": 1  }}

The endpoint to call after a payment when you need to know what actually happened. It returns the whole order — every transaction attempted against it, each one's response code, and Kashier's own reconciliation verdict — so you can settle the question "was this paid?" from Kashier's records rather than from a webhook you may have missed.

Read the order status, not the HTTP status. A declined payment is still an HTTP 200 here, and inside transactions[] a declined attempt is still a stored transaction. Branch on the order-level status (CAPTURED is the paid state) and, per transaction, on status together with transactionResponseCode.

search is required, and it is a partial, case-insensitive match on your own merchantOrderId — not on Kashier's order id. Calling without it returns a 400. (Kashier's older published docs name this parameter merchantOrderId; the parameter the API actually accepts is search.)

A merchant's calls are always scoped to their own MID, which is taken from the credential — you cannot read another merchant's orders by passing a different merchantId.

Query Parameters

Response Body