Developers
Read bookings, orders, and menus across your restaurants. Push new bookings server-to-server. Subscribe to webhooks for real-time integrations.
Authentication
Every request needs an Authorization: Bearer oac_live_… header. Keys are issued in your company dashboard and scoped to all restaurants under that company.
curl https://www.openalacarte.com/api/v1/bookings \ -H "Authorization: Bearer oac_live_<your-key>"
Rate limit: 120 requests/minute per key. 429 returns a Retry-After header.
Endpoints
/api/v1/bookings
List bookings across your restaurants. Filter by restaurantId, status, date range. Cursor-paginated.
/api/v1/bookings
Create a guest booking server-to-server. Returns confirmCode the integrator hands back to the diner.
/api/v1/orders
List orders. Filter by restaurantId, status, type (DINE_IN/TAKEAWAY/DELIVERY).
/api/v1/orders/{id}/status
Update an order's status (CONFIRMED, PREPARING, READY, DELIVERED, CANCELLED). Triggers the standard diner notification.
/api/v1/orders/{id}/refund
Refund a paid order in full via Stripe. Reverses application fee + funds in one call.
/api/v1/menu-items
List menu items across your restaurants. Includes price, allergens, tags, stock.
Quick example — list today's bookings
curl "https://www.openalacarte.com/api/v1/bookings?from=$(date -u +%Y-%m-%d)&status=CONFIRMED" \
-H "Authorization: Bearer oac_live_<your-key>"
# Response:
# {
# "data": [
# { "id": "...", "restaurantId": "...", "date": "2026-05-28T…",
# "time": "19:30", "partySize": 4, "status": "CONFIRMED",
# "confirmCode": "abc12345", "diner": { "name": "...", "email": "..." } }
# ],
# "nextCursor": null
# }Webhooks
Subscribe to events to react in real time. We POST a signed JSON payload to your endpoint; you respond 200 within 10 seconds.
booking.created
A booking was made.
booking.status_changed
A booking moved status (e.g. confirmed → cancelled).
order.created
A new order was placed.
order.status_changed
An order moved status (CONFIRMED → PREPARING → READY → DELIVERED).
review.created
A new review landed for one of your restaurants.
menu_item.updated
A menu item was edited (price, description, stock).
Each delivery has X-OAC-Signature: sha256=… — HMAC-SHA256 of the body with the endpoint secret. Verify before trusting.