# Introduction

> What the BackResto Partner API exposes today, what it deliberately does not, and who decides.

Source: https://developers.backresto.com/en/docs/introduction

BackResto is the HACCP compliance app food-service teams fill in during service:
goods-in checks, cooking and cooling temperatures, cleaning plans, labels. The
**Partner API** hands that record to the software your customers already run:
an ERP, a supplier portal, a quality dashboard, an AI assistant.

It is a read-only HTTP API with one authentication scheme and one error shape,
described end to end by an
[OpenAPI document](https://api.backresto.com/openapi.json) you can load straight
into a client generator or an LLM tool definition. The same data is reachable
over [MCP](https://developers.backresto.com/en/docs/mcp) at `https://api.backresto.com/mcp`, with the same key and
the same permissions, if what you want is to ask questions rather than write a
client.

## The restaurant decides what you see

This is the part worth reading twice, because it is different from most APIs
you will integrate with.

There is no sign-up. A key is issued by hand, scoped to named restaurants and
named scopes, and only once the restaurants in question have agreed to it. Ask
for one by email ([Getting a key](https://developers.backresto.com/en/docs/access) is the checklist), and it
arrives at the technical contact you name.

The consequence is a firm one: a key reaches the restaurants it was granted and
nothing else. `restaurant-3` does not appear because `restaurant-1` and
`restaurant-2` are on the same key, and no request you can make widens that.
Adding a site is another conversation, with the people whose data it is.

The upside of a small manual step is that revocation is just as direct: one
email and the key is dead on the next request.

## What is in the data

| Resource | What it is |
| --- | --- |
| [Deliveries](https://developers.backresto.com/en/docs/deliveries) | Two collections: one record per goods-in check (supplier, compliance verdict, non-compliance reasons, corrective actions, free-text commentary, a temperature reading per product, always in Celsius), and the photographs taken at reception. |
| [Collections & records](https://developers.backresto.com/en/docs/collections) | Twenty-four further record types, sharing one envelope and documented by domain: [temperatures](https://developers.backresto.com/en/docs/temperatures), [cooling and food processes](https://developers.backresto.com/en/docs/food-processes), [cleaning](https://developers.backresto.com/en/docs/cleaning), [fryers](https://developers.backresto.com/en/docs/fryers), [surface analyses](https://developers.backresto.com/en/docs/surface-analyses), [traceability labels](https://developers.backresto.com/en/docs/traceability-labels), [documents](https://developers.backresto.com/en/docs/drive-files), [catalogue](https://developers.backresto.com/en/docs/catalogue) and the [facilities and people](https://developers.backresto.com/en/docs/facilities) behind them. |

All of it is read-only. Nothing a partner key can call writes to a restaurant's
records: the app is where compliance data is created, by the person who is
accountable for it.

## What is not here yet

Being explicit about the edges saves you an afternoon:

- **No historical backfill.** A restaurant's records become visible to this API
  from the moment capture is switched on for that restaurant. What came before
  is in the app, not here, except for deliveries, which carry the history the
  app still held. Do not treat an empty walk as proof that nothing happened.
  See [Support](https://developers.backresto.com/en/docs/support).
- **No writes, no webhooks.** You poll. If you need to be pushed to, tell us;
  it is a question of demand, not of principle.
- **No incremental cursor on collections.** Refreshing a collection means
  walking it again and reconciling on `id`.
- **No BackResto account sign-in.** The partner key remains the credential.
  URL-only [MCP](https://developers.backresto.com/en/docs/mcp) clients, including Claude and ChatGPT, can connect
  through OAuth: a BackResto page opens for you to paste the key. Permissions
  remain those of that key.

## Base URLs

| Environment | Origin |
| --- | --- |
| Production | `https://api.backresto.com` |
| Pre-production | `https://api-preprod.backresto.com` |
| Development | `https://api-dev.backresto.com` |

A key is provisioned in one environment and means nothing in the others: keys,
grants and data are per-environment. Everything below uses the production
origin.

Ready? [Make your first call](https://developers.backresto.com/en/docs/quickstart).