REST API reference

The Integration API is a plain JSON REST API. It is meant for server-to-server calls — your website’s own backend calls OrderRestro — not for putting a key in browser JavaScript. Orders and bookings arrive live on the dashboard and the kitchen display, and (if you turn the setting on) wait for a staff member to accept them first.

Looking to connect an AI assistant instead? See the MCP server docs. To be told when things happen, see webhooks.

Base URL (replace with your own domain):

https://<your-orderrestro-domain>/api/v1/integrations

Create a key in Settings > API Keys > Integration API keys > New key. Give it a name, optionally limit it to one location, and tick only the scopes it needs. The key (it starts with ordr_ext_) is shown in full once; only a masked last four characters are kept afterwards. Revoking a key takes effect immediately.

Authorization: Bearer ordr_ext_xxxxxxxxxxxxxxxx

A leaked key can only ever do what its scopes and location allow — nothing else.

curl -H "Authorization: Bearer ordr_ext_..." \
  https://your-domain/api/v1/integrations/locations/<branchId>/menu

Returns the location and its categories with active items, so your site can render a live menu.

curl -H "Authorization: Bearer ordr_ext_..." \
  "https://your-domain/api/v1/integrations/locations/<branchId>/delivery-quote?pincode=700001"

{ "deliverable": true, "zoneName": "Central", "fee": 40, "minOrderAmount": 150, "etaMinutes": 30 }

{ "deliverable": false } means the pincode is outside every delivery zone. Zones are set up by the restaurant under Delivery > Zones.

curl -X POST https://your-domain/api/v1/integrations/locations/<branchId>/orders \
  -H "Authorization: Bearer ordr_ext_..." \
  -H "Content-Type: application/json" \
  -d '{
    "type": "DELIVERY",
    "customerName": "Jane Doe",
    "customerPhone": "+919800000000",
    "delivery": { "address": "12 Park Street", "pincode": "700001", "phone": "+919800000000" },
    "scheduledFor": "2026-10-10T13:30:00.000Z",
    "notes": "No onions",
    "items": [{ "menuItemId": "…", "quantity": 2, "modifierIds": ["…"], "kitchenNote": "extra spicy" }]
  }'

The response is the created order, including its kitchen ticket. Online orders may wait for a staff member to accept them (a setting under Settings > Online orders); the kitchen doesn’t see them until then.

curl -H "Authorization: Bearer ordr_ext_..." \
  https://your-domain/api/v1/integrations/locations/<branchId>/orders/<orderId>

Returns items, kitchen-ticket progress, payments, and (for deliveries) the delivery status. Prefer webhooks over polling if you need to react to changes.

curl -X POST https://your-domain/api/v1/integrations/locations/<branchId>/reservations \
  -H "Authorization: Bearer ordr_ext_..." \
  -H "Content-Type: application/json" \
  -d '{ "customerName": "Jane Doe", "phone": "+919800000000",
        "guestCount": 4, "reservedAt": "2026-10-12T19:00:00Z", "durationMinutes": 90 }'

Online bookings are capped at what the location’s two largest tables can seat; a bigger party gets a 400 asking the guest to phone the restaurant. Statuses are RESERVED, CONFIRMED, ARRIVED, COMPLETED, CANCELLED and NO_SHOW.

{ "message": "Sorry, we do not deliver to that pincode", "error": "Bad Request", "statusCode": 400 }

Creating orders or bookings is limited to 60 requests per minute per caller, on top of a 300 per minute app-wide default.