> ## Documentation Index
> Fetch the complete documentation index at: https://www.dropfans.io/developers/llms.txt
> Use this file to discover all available pages before exploring further.

# GET /api/external/orders — List paid orders (per-fan references)

> Paid drop orders of the key's account, newest first — the polling twin of the [drop.paid webhook](/developers/webhooks/overview).

- Source: https://www.dropfans.io/developers/reference/list-orders
- Section: API reference
- OpenAPI: https://www.dropfans.io/developers/openapi.json

Paid drop orders of the key's account, newest first — the polling twin of the [drop.paid webhook](https://www.dropfans.io/developers/webhooks/overview.md).

Filter by `externalRef` to answer "did this fan pay?" on a shared drop, or by `productId` / `since` to sweep. Refunded and charged-back orders stay in the list with their `status` — act on `status: "paid"` only.

## Authentication

`Authorization: Bearer dpfn_...` — an API key generated in the creator's dashboard (Vault → API Connect). One key = one creator. Missing or invalid keys return 401 `{"error":"Unauthorized","code":"unauthorized"}`.

## Query parameters

| Field | Type | Required | Description |
|---|---|---|---|
| `productId` | string |  | Only orders for this drop. |
| `externalRef` | string |  | Only orders bought through links carrying this reference. |
| `since` | string |  | Only orders paid at or after this time. |
| `limit` | integer |  | Page size. |
| `cursor` | string |  | `nextCursor` from the previous page. |

## Responses

### 200

A page of orders.

| Field | Type | Required | Description |
|---|---|---|---|
| `orders` | Order[] | yes | Newest first. |
| `nextCursor` | string \\| null |  | Pass as `cursor` for the next page; null on the last page. |

```json
{
  "orders": [
    {
      "orderId": "clxor0001order",
      "productId": "clxdr0p000001prod",
      "accountId": "clx2f8a1b0001qw3k",
      "externalRef": "tg_48213377",
      "amountCents": 2750,
      "currency": "USD",
      "paidAt": "2026-10-17T16:20:00.000Z",
      "paidWith": "card",
      "status": "paid",
      "buyer": {
        "id": "clxbu0001buyer",
        "email": "buyer@example.com",
        "telegramUserId": "48213377",
        "telegramUsername": "fan_one"
      }
    }
  ],
  "nextCursor": null
}
```

## Errors

| Status | Body | When |
|---|---|---|
| 400 | `{"error":"externalRef must be 1–32 of A-Z a-z 0-9 _ -"}` | Malformed reference. |
| 400 | `{"error":"since must be an ISO date"}` | Unparseable `since`. |
| 401 | `{"error":"Unauthorized","code":"unauthorized"}` | Missing or invalid API key. |

## Rate limiting

Per-key fixed windows by tier (Personal 60/min · 5,000/day; approved apps 300/min · 50,000/day; Dropfans-operated integrations exempt). Read the live values from X-RateLimit-Tier, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and their -Day variants; a 429 carries Retry-After and `{"error":"Rate limit exceeded","code":"rate_limited"}`. See [Rate limits](https://www.dropfans.io/developers/concepts/rate-limits.md).

## Code samples

### curl

```bash
curl "https://www.dropfans.io/api/external/orders?productId=clxdr0p000001prod&externalRef=tg_48213377" \
  -H "Authorization: Bearer $DROPFANS_API_KEY"
```

### Node

```javascript
const res = await fetch(`https://www.dropfans.io/api/external/orders?productId=clxdr0p000001prod&externalRef=tg_48213377`, {
  headers: {
    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
  },
});
console.log(await res.json());
```

### Python

```python
import os
import requests

res = requests.get(
    "https://www.dropfans.io/api/external/orders",
    headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
    params={"productId": "clxdr0p000001prod", "externalRef": "tg_48213377"},
)
print(res.json())
```

## OpenAPI

```json
{
  "method": "GET",
  "path": "/api/external/orders",
  "operationId": "listOrders",
  "tags": [
    "drops"
  ],
  "summary": "List paid orders (per-fan references)",
  "description": "Paid drop orders of the key's account, newest first — the polling twin of the [drop.paid webhook](https://www.dropfans.io/developers/webhooks/overview.md).\n\nFilter by `externalRef` to answer \"did this fan pay?\" on a shared drop, or by `productId` / `since` to sweep. Refunded and charged-back orders stay in the list with their `status` — act on `status: \"paid\"` only.",
  "parameters": [
    {
      "name": "productId",
      "in": "query",
      "required": false,
      "description": "Only orders for this drop.",
      "schema": {
        "type": "string"
      },
      "example": "clxdr0p000001prod"
    },
    {
      "name": "externalRef",
      "in": "query",
      "required": false,
      "description": "Only orders bought through links carrying this reference.",
      "schema": {
        "type": "string",
        "maxLength": 32,
        "pattern": "^[A-Za-z0-9_-]{1,32}$"
      },
      "example": "tg_48213377"
    },
    {
      "name": "since",
      "in": "query",
      "required": false,
      "description": "Only orders paid at or after this time.",
      "schema": {
        "type": "string",
        "format": "date-time"
      }
    },
    {
      "name": "limit",
      "in": "query",
      "required": false,
      "description": "Page size.",
      "schema": {
        "type": "integer",
        "default": 50,
        "minimum": 1,
        "maximum": 100
      }
    },
    {
      "name": "cursor",
      "in": "query",
      "required": false,
      "description": "`nextCursor` from the previous page.",
      "schema": {
        "type": "string"
      }
    }
  ],
  "responses": {
    "200": {
      "description": "A page of orders.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "orders": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "orderId": {
                      "type": "string",
                      "description": "The order id. Unique per sale — dedupe on it.",
                      "example": "clxor0001order"
                    },
                    "productId": {
                      "type": "string",
                      "description": "The drop that was bought.",
                      "example": "clxdr0p000001prod"
                    },
                    "accountId": {
                      "type": "string",
                      "description": "The creator who sold it (the account behind the key).",
                      "example": "clx2f8a1b0001qw3k"
                    },
                    "externalRef": {
                      "type": [
                        "string",
                        "null"
                      ],
                      "description": "Your per-fan checkout reference from the link the buyer opened (`?m=` on the web, `b_{productId}_{ref}` in Telegram). Null when the buyer came without one. Not proof of identity — the buyer can edit the link.",
                      "example": "tg_48213377",
                      "maxLength": 32,
                      "pattern": "^[A-Za-z0-9_-]{1,32}$"
                    },
                    "amountCents": {
                      "type": "integer",
                      "description": "Gross buyer-paid total in **cents** (VAT included).",
                      "example": 2750
                    },
                    "currency": {
                      "type": "string",
                      "description": "Always USD.",
                      "enum": [
                        "USD"
                      ],
                      "example": "USD"
                    },
                    "paidAt": {
                      "type": [
                        "string",
                        "null"
                      ],
                      "description": "When the payment settled (UTC).",
                      "format": "date-time"
                    },
                    "paidWith": {
                      "type": "string",
                      "description": "Card, or the buyer’s prepaid wallet credits.",
                      "enum": [
                        "card",
                        "credits"
                      ],
                      "example": "card"
                    },
                    "status": {
                      "type": "string",
                      "description": "Current state of the sale.",
                      "enum": [
                        "paid",
                        "refunded",
                        "charged_back"
                      ],
                      "example": "paid"
                    },
                    "buyer": {
                      "type": "object",
                      "properties": {
                        "id": {
                          "type": [
                            "string",
                            "null"
                          ],
                          "description": "The buyer’s account id, when signed in."
                        },
                        "email": {
                          "type": [
                            "string",
                            "null"
                          ],
                          "description": "Billing / account email.",
                          "format": "email"
                        },
                        "telegramUserId": {
                          "type": [
                            "string",
                            "null"
                          ],
                          "description": "Telegram user id (as a string) when the buyer used the Mini App — cross-check it against your externalRef.",
                          "example": "48213377"
                        },
                        "telegramUsername": {
                          "type": [
                            "string",
                            "null"
                          ],
                          "description": "Telegram @username without the @, when known."
                        }
                      },
                      "description": "Who paid. Every field may be null for a guest checkout."
                    }
                  },
                  "required": [
                    "orderId",
                    "productId",
                    "accountId",
                    "amountCents",
                    "currency",
                    "paidWith",
                    "status",
                    "buyer"
                  ]
                },
                "description": "Newest first."
              },
              "nextCursor": {
                "type": [
                  "string",
                  "null"
                ],
                "description": "Pass as `cursor` for the next page; null on the last page."
              }
            },
            "required": [
              "orders"
            ]
          },
          "example": {
            "orders": [
              {
                "orderId": "clxor0001order",
                "productId": "clxdr0p000001prod",
                "accountId": "clx2f8a1b0001qw3k",
                "externalRef": "tg_48213377",
                "amountCents": 2750,
                "currency": "USD",
                "paidAt": "2026-10-17T16:20:00.000Z",
                "paidWith": "card",
                "status": "paid",
                "buyer": {
                  "id": "clxbu0001buyer",
                  "email": "buyer@example.com",
                  "telegramUserId": "48213377",
                  "telegramUsername": "fan_one"
                }
              }
            ],
            "nextCursor": null
          }
        }
      }
    },
    "400": {
      "description": "Malformed reference. Also: Unparseable `since`.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message describing what went wrong.",
                "example": "Vault item not found"
              }
            },
            "required": [
              "error"
            ]
          },
          "example": {
            "error": "externalRef must be 1–32 of A-Z a-z 0-9 _ -"
          }
        }
      }
    },
    "401": {
      "description": "Missing or invalid API key.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Unauthorized",
            "code": "unauthorized"
          }
        }
      }
    },
    "403": {
      "description": "The app this key belongs to has been suspended by Dropfans. Every request fails with this until the app is reinstated — surface it to the creator and contact Dropfans.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "This integration has been suspended by Dropfans. Contact the app developer.",
            "code": "app_suspended"
          }
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded for the current minute or day window. Wait Retry-After seconds and retry.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "Retry-After": {
          "description": "Seconds to wait before retrying (sent with 429s).",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Rate limit exceeded",
            "code": "rate_limited"
          }
        }
      }
    }
  },
  "x-codeSamples": [
    {
      "lang": "cURL",
      "label": "curl",
      "source": "curl \"https://www.dropfans.io/api/external/orders?productId=clxdr0p000001prod&externalRef=tg_48213377\" \\\n  -H \"Authorization: Bearer $DROPFANS_API_KEY\""
    },
    {
      "lang": "JavaScript",
      "label": "Node",
      "source": "const res = await fetch(`https://www.dropfans.io/api/external/orders?productId=clxdr0p000001prod&externalRef=tg_48213377`, {\n  headers: {\n    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,\n  },\n});\nconsole.log(await res.json());"
    },
    {
      "lang": "Python",
      "source": "import os\nimport requests\n\nres = requests.get(\n    \"https://www.dropfans.io/api/external/orders\",\n    headers={\"Authorization\": f\"Bearer {os.environ['DROPFANS_API_KEY']}\"},\n    params={\"productId\": \"clxdr0p000001prod\", \"externalRef\": \"tg_48213377\"},\n)\nprint(res.json())"
    }
  ],
  "x-dropfans-docs": "https://www.dropfans.io/developers/reference/list-orders"
}
```

---

Previous: [Check which drops sold (batch)](https://www.dropfans.io/developers/reference/check-drop-status.md) · Next: [Publish a post to the For You feed](https://www.dropfans.io/developers/reference/create-post.md) · All pages: [llms.txt](https://www.dropfans.io/developers/llms.txt)