WDT Enterprise Edition Integration Guide: Signing and Order Query

API Shape

WDT Enterprise Edition exposes openapi2-style endpoints: POST https://api.wangdian.cn/openapi2/{service}.php — for example sales_order_query.php for orders and stockout_order_query.php for outbound orders. Authentication parameters (sid, appkey, timestamp, sign) go in the URL query; the business payload goes in the body.

The Four Credential Elements

sid is the seller API account applied for in the WDT console, and appkey is bound to it. The timestamp is the most commonly missed detail: it is the number of seconds since 1970-01-01 08:00:00 Beijing time, not a Unix timestamp — compute it against the Asia/Shanghai baseline. The server tolerates at most a 5-minute clock skew.

Signing Algorithm

Sort all query parameters except sign by parameter name; concatenate them as key1value1key2value2...; wrap the string with the appsecret at both ends (appsecret + payload + appsecret); then MD5 it to a hex string. The body does not participate in signing, and parameter values must not be URL-encoded before signing. Some endpoints require a {} placeholder body when there is no payload.

Body: gzip + base64

The openapi2 body is not raw JSON: the business JSON is gzip-compressed, then base64-encoded before sending. Responses may likewise be compressed — check the response headers and decompress. Wrap this in a shared client so business code only ever sees JSON.

Order Query in Practice

sales_order_query.php accepts a time range (incremental by last-modified time), order status filters, and pagination (page_no / page_size). Recommendations: pull increments by modified time with the window slightly overlapped and deduplicate by order number; respect the documented page_size ceiling and loop until a short page signals the end; filter statuses server-side to cut transfer volume; and preserve the marketplace original order number — it is your idempotency key when later writing into the ERP.

Common Issues

Signature errors are almost always a Unix-timestamp mistake or unsorted parameters. "Time deviation exceeded" means your server clock is more than five minutes off Beijing time — fix NTP before debugging the signature. Body parse failures mean you forgot gzip, or your base64 contains newlines. Rate limits are enforced per sid; back off and retry on the corresponding error codes, and confirm your quota before polling aggressively.