List orders

There is no REST endpoint that lists orders with an API key. The submit call hands you one order code and that code is the handle you keep — store it the moment you get it. The listing that exists, GET /api/orders, is authenticated by a signed-in browser session and returns every order on the account: website orders and orders placed with the account's API key. It is what /orders and its statement are built from. With a key and no browser, the MCP tool list_my_orders gives the same view, capped at the 20 most recent.

Request#

No path parameters, no query parameters, no body. The account is taken from the session cookie, so there is nothing to pass and no way to ask for somebody else's orders. Call it from a signed-in page in the browser; an API key will not authenticate it.

const res = await fetch("/api/orders", { credentials: "include" });
if (res.status === 401) {
  window.location.href = "/auth/login";
} else {
  const { orders } = await res.json();
  console.log(orders.length, orders[0]?.id, orders[0]?.status);
}

Response#

{
  "orders": [
    {
      "id": "2610014",
      "email": "[email protected]",
      "type": "cart_order",
      "status": "shipped",
      "total": 24.87,
      "items": "2x Hinge bracket — PLA, Black; 1x Cable clip — PETG, Cyan",
      "shippingAddress": {
        "name": "Ada Lovelace",
        "line1": "1100 Congress Ave",
        "city": "Austin",
        "state": "TX",
        "postal_code": "78701",
        "country": "US"
      },
      "trackingNumber": "9400111899223197428490",
      "carrier": "usps",
      "createdAt": "2026-09-01T18:33:00.000Z",
      "updatedAt": "2026-09-04T11:02:11.412Z"
    }
  ]
}

The documents are returned exactly as they are stored — nothing is projected away, and optional fields are absent rather than null when they were never set.

Ordering and limits#

• At most 50 website orders and 100 print API orders come back. The limits are fixed in the queries — there is no cursor, offset or page parameter.
• The two lists are merged and sorted newest first by createdAt, in the application rather than in the database.
• The 100 API orders are the newest 100. The website sort happens after its limit, so an account with more than 50 website orders gets an arbitrary 50 of them sorted, not the newest 50. Keep your own record if you need complete history.
• Website orders are matched on the order's email, and print API orders on the account that placed them, both lowercased and trimmed. There is no parameter that could reach another account's data.
• An account with no orders gets 200 and an empty array, as does a deployment with no order database configured.

Tracking orders you submitted with a key#

1. 1
   Save the code on submit

   The 201 from POST /api/print/orders carries code, statusUrl and apiStatusUrl. Write the code to your own database against your own order id before you do anything else.

2. 2
   Poll each code you are still waiting on

   GET /api/print/orders/{code} with the same key returns status, paid and tracking. Poll on a human timescale — prints take hours.

   bashCopy

   curl https://x3dstudios.com/api/print/orders/X3D-K7M2QP \
     -H "Authorization: Bearer $X3D_API_KEY"

3. 3
   Stop polling at a terminal status

   DELIVERED, CANCELLED and REJECTED do not change again. Drop those codes from the poll loop.