R
Docs
API Documentation

API — getting started

Five-minute primer so you can make your first API call.

1 min read Updated 5/28/2026developer

Base URL + environments

  • Production — https://api.restora360.com (or your tenant's subdomain, depending on the endpoint)
  • Local dev — http://localhost:3000

Most endpoints live under /api/.... Tenant-scoped endpoints use /api/tenant/[tenantId]/...; public endpoints (no auth) use /api/public/[tenantId]/....

Authentication

Restora 360 uses HTTP-only session cookies (platform_session) signed with HS256 JWT. There are four cookie types:

  • platform_session — tenants, designers, agents
  • admin_session — super-admin (separate cookie to avoid collisions)
  • customer_session — customer accounts (per-tenant)

API key auth is coming in Phase 3 (see Developer docs). For now, integration scenarios are limited to first-party server-to-server via the cookie.

Your first call

Get the menu of a tenant (public endpoint, no auth):

Shell
curl https://api.restora360.com/api/public/luigi/menu

Returns JSON with categories + products. See the full API reference (coming soon) for every endpoint.

Rate limits

Public endpoints: 60 requests / minute / IP. Authenticated tenant endpoints: 600 / minute / tenant. Exceeding returns HTTP 429 with a Retry-After header. Increase via your Enterprise contract.

Errors

Standard envelope:

JSON
{ "error": "human-readable message", "code": "OPTIONAL_CODE", "detail": "optional extra context" }

HTTP status codes follow REST conventions (200, 201, 400, 401, 403, 404, 409, 422, 429, 500).

Frequently asked

  • Coming in Phase 3 alongside a downloadable Postman collection.