## Overview
Hupun ERP's OPEN APIs use one gateway host with REST resource paths: https://open-api.hupun.com/api plus paths like /erp/opentrade/list/trades. Requests are POST with application/x-www-form-urlencoded. There is no token issuance — every call authenticates with system parameters plus an MD5 signature. Note the OPEN APIs and the B2C APIs (self-owned mall push) use separate credential pairs and must not be mixed.
### System parameters
| Parameter | Meaning |
| --- | --- |
| _app | OPEN AppKey from the developer console |
| _t | Timestamp (seconds) |
| _sign | Signature |
### Signing steps
1. Merge system and business parameters (except _sign) and sort ascending by name.
2. Concatenate as key+value pairs.
3. Prepend and append the Secret.
4. MD5 the result — that is _sign.
Hupun offers an online signature verifier plus Java/Python SDKs; check a self-rolled signer against the official tool first.
### Response
All APIs return {"code":0,"msg":"success","data":{...}}; a non-zero code comes with a msg. Common failures: bad signature (wrong _sign math or Secret), excessive timestamp skew, and AppKey lacking the API permission.
### Production advice
The Qeasy Hupun connector embeds signing and throttling. For custom integrations, pass the official signature tool before touching business parameters — make "signature parity achieved" the first acceptance gate of joint debugging.