## Overview
The WDT Enterprise (Qiyebang) OpenAPI is REST-flavored: every business interface is its own .php endpoint (trade_query.php, stock_query.php, ...) under sandbox.wangdian.cn (test) or api.wangdian.cn (production). Requests are POST with application/x-www-form-urlencoded. There is no token issuance — each call authenticates itself with common parameters plus an MD5 signature.
### Common parameters
| Parameter | Meaning |
| --- | --- |
| sid | Seller account (the WDT login account) |
| appkey | Application key issued when API authorization is granted |
| timestamp | Seconds from 1970-01-01 08:00:00 Asia/Shanghai to now; ±5 minutes tolerated |
| sign | Signature |
### Signing steps
1. Take every request parameter except sign (common + business) and sort ascending by name.
2. Concatenate as key1value1key2value2 without URL-encoding.
3. Prepend and append the interface secret.
4. MD5 the final string (32-char hex) — that is the sign.
### Pitfalls
- timestamp is a Beijing-timezone epoch, not the standard Unix epoch — the classic trap for servers in other timezones.
- Pagination parameters (pageno/pagesize) join the signature too; any change requires re-signing.
- Signature errors, invalid sid and missing API permission surface in the status/message fields of the response and deserve distinct alerting.