Order Tracking

Wasal provides a public tracking endpoint you can expose directly to your customers — for example, behind a "Track my order" link in a confirmation email or web page. It requires no API key.

Public tracking

GET /integration/merchant/order/track/:orderNumber

Public — no authentication.

Pass the human-readable orderNumber (e.g. MAIN-000123) returned when the order was created.

Response:

{
  "success": true,
  "data": {
    "orderNumber": "MAIN-000123",
    "status": "in_transit",
    "agentLocation": { "lat": 29.3759, "lng": 47.9774, "lastSeen": "2026-06-21T10:42:00.000Z" },
    "agentPhone": "+96599998888",
    "updatedAt": "2026-06-21T10:42:05.000Z"
  }
}

Field	Description
orderNumber	The order's public number.
status	Current status (see the lifecycle).
agentLocation	Live { lat, lng, lastSeen } of the driver — only present while the order is assigned, on_way_to_merchant, picked_up, or in_transit and the driver is online. null otherwise.
agentPhone	Driver's phone number while assigned and online. null otherwise.
updatedAt	When the order was last updated.

Because this endpoint is public, it deliberately exposes only non-sensitive tracking fields — no customer details, pricing, or items.

Polling vs. webhooks

To keep your system in sync with order status:

• Polling — periodically call GET /integration/merchant/order/:orderId (authenticated) or the public track endpoint above. Simple to implement; suitable for low volumes.
• Webhooks — register a webhook in the merchant dashboard to receive a push when an order's status changes. This avoids polling and gives near-real-time updates. Webhook payloads are signed with an HMAC-SHA256 signature in the X-Wasal-Signature header so you can verify authenticity. See the WooCommerce integration for the webhook payload and signature format — the same mechanism is available to any integration.

For closed testing, create orders with the Demo Merchant and move them through the normal Demo Delivery Partner and Demo Driver workflows. Webhooks fire normally, so use a controlled test endpoint.