List your orders

Every order your account bought, newest first, with filters, paging and CSV export.

GET/api/v1/orders

The same orders /order shows you: everything bought with your account's email address, through the API or the website. JSON, or CSV with format=csv.

Request

curl "https://www.nfa.pub/api/v1/orders?state=partial,refunded&created_after=2026-10-01&limit=100" \  -H "X-Api-Key: rsk_..."

Response

{  "ok": true,  "orders": [    {      "order": "339620d0e1843b5b-cc957e7efa86a0db",      "product": "rust-500-999-hours",      "quantity": 2,      "delivered": 1,      "state": "partial",      "amountCents": 290,      "refundedCents": 145,      "currency": "EUR",      "createdAt": "2026-10-25T14:31:01.489Z",      "preorder": false,      "deliveryWindow": null,      "warranty_hours": 6,      "warranty_extended": false    }  ],  "nextCursor": "Q2hhbmdlTWU..."}

Parameters

Parameter	Description
`limit`	Page size, 1 to 100. Default 50.
`cursor`	The `nextCursor` from the previous page, passed back unchanged. It is opaque: do not build or decode it.
`created_after`	Inclusive. Unix seconds or ISO 8601 (`2026-10-01`, `2026-10-01T12:00:00Z`). No offset means UTC.
`created_before`	Exclusive, same formats. `created_after=2026-10-01&created_before=2026-11-01` is exactly October.
`format`	`csv` for a CSV download. The next page's cursor is then in the `X-Next-Cursor` header.
`state`	Only these states, comma separated: `awaiting_payment`, `preorder`, `processing`, `partial`, `delivered`, `refunded`, `cancelled`.
`product`	Only these product ids, comma separated (up to 20).
`include`	`accounts` adds an `accounts` array of delivered login lines to each order. Full keys only, and not with `format=csv`.

Fields

order is the id /order and /replace accept: the order_id your buy returned.
amountCents is what the order was invoiced at, and refundedCents what has gone back to your balance for it. What you paid net is the difference.
createdAt is ISO 8601, UTC.
preorder and deliveryWindow mean the same as on /order. state=preorder lists the ones still waiting with nothing delivered yet; a part-filled one is partial, with preorder: true.
warranty_hours is 12 and warranty_extended true for an order bought with the extended warranty, otherwise 6 and false.
preorder, deliveryWindow, warranty_hours and warranty_extended are not in the CSV export.

Paging

Newest first. Call again with cursor set to the last nextCursor until it comes back null.
Pages never shift: rows that arrive while you page through do not push rows onto the next page or show one twice.
Anything malformed (a limit of 0 or 500, an unreadable date, a cursor from another endpoint or account) is refused with E1101, never guessed at.

Logins

Logins are left out unless you ask with include=accounts, and only a full key may ask: a read-only key gets E1701, so a monitoring key cannot pull every account you ever bought. They are never in a CSV (E1101). To fetch one order's logins, use /order with a full key.

Errors

Code	HTTP	Meaning
`E1001`	401	The key is missing, malformed, revoked or unknown.
`E1002`	429	Too many requests. Wait for the minute to roll over and retry. See Rate limits.
`E1101`	400	A required parameter is missing, or one is not valid (a bad `limit`, date or `cursor` on the list endpoints, for example).
`E1701`	403	`include=accounts` with a read-only key.
`E1702`	403	The request came from an IP that is not on your allowlist.
`E1000`	500	Something went wrong on our side. Retry, and contact support if it keeps happening.

Rate limits: 60 requests a minute per IP address, and 30 a minute per account.