R
Docs
API Documentation

Orders API

The endpoints you call to drive a customer order through the kitchen.

1 min read Updated 5/28/2026developer

Create an order

POST /api/public/[tenantId]/orders

Public — no auth. Used by the storefront and any POS integration.

Body:

JSON
{
  "type": "pickup",
  "customerName": "Alex",
  "customerEmail": "alex@example.com",
  "customerPhone": "+46700000000",
  "items": [
    {
      "productId": "p_pizza_marg",
      "productName": "Margherita",
      "quantity": 2,
      "price": 12.50,
      "selectedOptions": { "Size": ["Large (+\$3.00)"] }
    }
  ],
  "paymentMethod": "cash",
  "couponCode": "WELCOME10",
  "giftCardCode": "XXXXXXXXXXXX"
}

Returns the persisted Order including id, orderNumber, escrowStatus, and (if non-cash) a Stripe payment-intent client secret.

List orders

GET /api/tenant/[tenantId]/orders — authenticated. Returns the tenant's most-recent orders (default 100, paginated with ?cursor=).

Query params:

  • status=pending|accepted|preparing|ready|delivered|rejected|canceled
  • from=YYYY-MM-DD / to=YYYY-MM-DD
  • paymentStatus=paid|pending|failed|refunded

Get a single order

GET /api/public/[tenantId]/orders/[orderId]?email=… (public) — read-only, requires the customer email match.

GET /api/tenant/[tenantId]/orders/[orderId] (tenant) — full operator view including timeline, escrow status, refund history.

Status transitions

PATCH /api/tenant/[tenantId]/orders/[orderId] updates the order status. Allowed transitions:

pending → accepted → preparing → ready → delivered

Plus two terminal jumps from any state: canceled (by customer or restaurant) and rejected (restaurant only).

Each transition:

  • Stamps the corresponding timestamp (acceptedAt, preparingStartedAt, …)
  • Appends a OrderTimelineEvent
  • Fires the customer notification email (for accepted, ready, delivered)
  • On ready: locks the order (no more customer-side cancellation) + runs the fraud-detection prep-speed check
  • On delivered: schedules the Stripe payout release after the configured escrow delay
  • On canceled / rejected: triggers refund flow if applicable
Shell
curl -X PATCH \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{"status":"accepted"}' \
  https://api.restora360.com/api/tenant/luigi/orders/ord_abc123

Customer-side cancellation

Public endpoint POST /api/public/[tenantId]/orders/[orderId]/cancel with { email, reason }. Gated by the escrow grace-period policy (default 5 minutes from order creation, before acceptance). Returns the refund amount + status.

Frequently asked

  • No — invalid transitions return 422. The Kanban board enforces the same rules in the UI.

Related articles