Public API

The Restro API lets the other software you run (accounting, delivery aggregation, loyalty, business intelligence) read your orders, menu, customers, and stock, and write back menu and stock changes.

It is a JSON over HTTPS API. Every request is scoped to one restaurant by the key it authenticates with, so a key only reaches data that belongs to that restaurant.

#Base URL

https://api.tryrestro.com/v1

#The shape of it

curl https://api.tryrestro.com/v1/orders \
  -H "Authorization: Bearer rk_a1b2c3d4e5f60718_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

{
  "data": [
    {
      "id": "cmd8x2k9p0001abcdefghijkl",
      "number": 1042,
      "type": "delivery",
      "status": "confirmed",
      "paymentStatus": "paid",
      "currency": "USD",
      "total": "52.41"
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 25,
    "total": 132,
    "totalPages": 6,
    "hasMore": true
  }
}

#Where to go next

1. Authentication: creating a key and using it.
2. Conventions: pagination, errors, rate limits, and money.
3. The endpoint references: Orders, Menu, Customers, Inventory.
4. Webhooks: receiving order events instead of polling for them.

If you only need to react to orders, start with the webhooks page. Polling /orders on a timer adds latency and consumes your rate limit.

#Frequently asked

#Where do I get an API key?

Owners and admins can create keys from Settings → Developers → Create key in the dashboard. Give the key a name, choose the scopes it needs, and optionally restrict it to specific branches or set an expiry. The full walkthrough is on the Authentication page.

#I lost my API key, can you show it again?

No. The token is shown once, when the key is created, and Restro stores only a SHA-256 hash of the secret, so it cannot be displayed again. Create a new key, deploy it, then revoke the old one from Settings → Developers.

#Can I create orders through the API?

No. The API can read orders and advance their status through POST /v1/orders/{reference}/status, but orders are placed through the website, the mobile app, and the point of sale. To follow them from your own systems, subscribe to the order webhooks.

#Why am I getting 404 for an order I know exists?

The key is most likely branch-scoped and the order belongs to a branch outside its scope. A branch-scoped key returns 404 rather than 403 for such orders, so it cannot confirm that they exist. Check the key's branchIds with GET /v1/me, and confirm you are passing the order id or the order number.

#My webhook endpoint receives the same event twice, is that a bug?

No. Delivery is at least once, so a retry after a slow but successful response sends the same event again. Every event carries a unique id; record the ids you have processed and ignore repeats.