API OTW v1

Connect shipping to your website, point of sale, or app.

1. Authentication

Create an API key in the Client Portal → Integrations tab. The key is shown only once — store it safely. Send it with every request:

Authorization: Bearer pt_xxxxxxxxxxxxxxxx

Alternative: the header X-API-Key: pt_xxxx. Limit 600 requests/minute per key. All data is automatically scoped to your own account.

2. Endpoints

GET /api/v1/ping

Check that the key is valid.

POST /api/v1/orders

Create an order. If you have a recurring pickup scheduled that day, the parcels attach to it automatically (attached: true).

{
  "packages": [
    { "recipient": "Siti Rahma", "area": "Kelapa Gading", "cod": 185000 },
    { "recipient": "Andi", "area": "Bekasi", "cod": 0 }
  ],
  "urgent": { "enabled": true, "date": "2026-08-11", "start": "14:00", "end": "16:00" }
}

Balasan berisi order_code, labels_url, dan tiap paket dengan awb + tracking_url. Bagian urgent opsional.

GET /api/v1/orders/{order_code}

Detail satu order beserta status tiap paket.

GET /api/v1/packages

Daftar paket. Filter: ?status=TERKIRIM, ?date=2026-08-10, ?limit=200.

GET /api/v1/packages/{awb}

Full status of one AWB plus its delivery attempt history.

GET /api/v1/settlements

Collected COD not yet paid out, plus payout history.

GET /api/v1/addressbook

Your recipient address book. Filter with ?q=name.

3. Package status

Status	Meaning
`DIBUAT`	Order created, waiting for a courier
`DIPICKUP`	Picked up by courier, heading to the hub
`DI_HUB`	Arrived at the sorting hub
`DIKIRIM`	Out for delivery to the recipient
`TERKIRIM`	Delivered (recipient name and proof photo recorded)
`GAGAL`	Delivery failed, rescheduled (`next_retry_date`)

4. Webhooks

Events: order.created · package.picked_up · package.at_hub · package.out_for_delivery · package.delivered · package.failed · settlement.created

POST https://website-anda.com/webhook
X-PT-Event: package.delivered
X-PT-Signature: sha256=<hmac>

{
  "event": "package.delivered",
  "sent_at": "2026-08-10 15:04:05",
  "data": { "package": { "awb": "GL2608100001", "status": "TERKIRIM", ... } }
}

Verify the signature (required)

Compute HMAC-SHA256 over the raw body using your webhook secret, then compare it with the X-PT-Signature header:

// Node.js
const sig = crypto.createHmac("sha256", SECRET).update(rawBody).digest("hex");
if ("sha256=" + sig !== req.headers["x-pt-signature"]) return res.status(401).end();

Reply 200 as fast as you can. If it fails we retry 5 times automatically, after 1, 5, 15, 60, then 360 minutes.

5. Public tracking

Every package has a login-free tracking page: /track/{awb} — safe to share with your buyers (it never shows the COD amount).