Customers

The customer endpoints are read-only. Restro is the system of record for who your diners are; creating customers from outside would produce duplicates nobody can reconcile.

#List customers

GET /v1/customers

Scope: customers:read.

Ordered newest first. A branch-scoped key only sees customers attached to its branches.

curl -G https://api.tryrestro.com/v1/customers \
  -H "Authorization: Bearer $RESTRO_API_KEY" \
  -d createdAfter=2026-07-01T00:00:00Z

#Fetch one customer

GET /v1/customers/{customerId}

Scope: customers:read.

{
  "id": "cmd8wa2b30003abcdefghijkl",
  "name": "Nour Hassan",
  "email": "nour@example.com",
  "phone": "+201000000000",
  "source": "website",
  "branchIds": ["cmd8w9k1a0002abcdefghijkl"],
  "createdAt": "2026-03-11T18:40:00.000Z",
  "updatedAt": "2026-07-28T10:12:04.000Z"
}

source is where the customer first came from: website, mobile_app, pos, or dashboard.

email and phone are both nullable — a guest who ordered by phone has no email, and Restro will not invent one.

#Getting a customer's orders

There is no /customers/{id}/orders. Use the orders endpoint and match on customer.id, or subscribe to order webhooks and build the history on your side as orders happen. The second is much cheaper if you need it continuously.

#A note on privacy

Customer records are personal data. A key with customers:read can export your entire customer list, so scope it deliberately, prefer an expiry, and revoke it the day the integration is retired.