Hi,
Well, it depends.
If the order was made by a guest, then it's possible to change the status of the order to cancelled by requesting the URL:
my-domain.com/index.php?option=com_hikashop&ctrl=order&task=cancel_order&order_id=XXX&order_token=YYY
where XXX is the id of the order and YYY is the token of the order (which guarantees that the person cancelling the order is the same person who placed the order).
If the order was made by someone connected with a user account, then that same URL, without the order_token parameter can be used, but only by someone logged in on the frontend of the website with the user account of that person (again for security reasons).
There is no mechanism to change the order status of orders to someone else from an URL. It would require some authentication mechanism, to make sure the person calling that URL has the authority to do that.
Now, it would be possible to develop a small plugin to answer calls to a special URL with code in the plugin to be able to change the order information. We actually developed a plugin which, appart from other things can also receive such requests to change the order status but also other things of an order.