Orders API - Query by Order_Number returns all Orders

[Will23]

Hello there,

I have some strange behaviour with the admin orders API. We have a service that constructs URLs to fetch orders on request from Shopify. Some are done by the name field, others by order number.

We've found if we use name, everything is as expected:

https://user:pass@clientshop.myshopify.com/admin/orders.xml?name=5256121&limit=1&status=open&financi...

If it doesn't exist, we get nothing. 

However if we exchange name with order_number (I've tried order-number as well) we get every order in the store. It seems that any filtering other than the limit is completely ignored. I'd expect nothing here, instead I'm getting 14MB xml files:

https://user:pass@clientshop.myshopify.com/admin/orders.xml?order_number=rndstr&limit=1&status=open&...

Any pointers on what is going wrong here? 

[KarlOffenberger]

Nothing much going wrong I'd think. Neither of them are documented filters. One works, the other doesn't. Seeing how both are readonly and name is the same as the order number prefixed with a hash, I'd simply use name for querying and call it a day - or?

Best wishes!

[Will23]

I'd expect the API to at least return nothing as opposed to the entire order contents of the store. 

However, in my case the name and order-number are different values within this store. Or are you saying order-number is a store configured combination of a prefix and the name field?

[Will23]

Actually, yes, name is the combination of those fields. Thanks for your help.