Quickstart

You need one thing: a partner key. It already knows which restaurants it was granted, and the API will tell you.

1. Get a key

Email contact@backresto.com with your company, the restaurants you need and the scopes you want. We confirm with the restaurant, then send the key to the technical contact you named. Getting a key is the full checklist. Sending it complete is what makes the round trip one email rather than four.

A key looks like this:

brp_hV8kZ2pQ.tW3nR7yL9cF1sB4xJ6mA8dK0gN5vE2uP7hQ3rT1zY6i

The half before the dot is a public prefix: it identifies the key in the list on that page and in support conversations, and it is safe to write down. The half after it is the secret, and it appears nowhere but that one screen.

2. Store it

Put the whole value in your secret manager, as one string, and delete the email it arrived in. Never a repository, never a URL, never a log line. We keep only a digest of the secret, so a lost key means a revocation and a new one. Write to us and both happen the same day.

export BACKRESTO_PARTNER_API_KEY='brp_…'

3. Find your restaurant

Ask the key which restaurants it reaches, and with which scopes:

curl "https://api.backresto.com/v1/restaurants" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY"

{
  "data": [
    {
      "restaurantId": "restaurant-1",
      "scopes": ["deliveries:read", "delivery-pictures:read", "temperature-records:read"]
    }
  ]
}

Most keys reach one restaurant. Keep its identifier for the calls below:

export RESTAURANT_ID='restaurant-1'

4. See which collections the key opens

Every record type, deliveries included, is a collection. Ask the key which ones it reaches:

curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY"

{
  "data": [
    {
      "collection": "deliveries",
      "readScope": "deliveries:read",
      "description": "Received shadow snapshots for deliveries; not complete primary-store history.",
      "stateKind": "received-shadow-snapshot",
      "payloadVersion": 1
    }
  ]
}

An empty data means the key has no collection grants yet. Ask for the ones you need.

5. Walk the deliveries

A collection is walked page by page with an opaque cursor. Timestamps are epoch milliseconds, as strings: that is the convention across the whole API, never seconds, never ISO 8601.

curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections/deliveries/records" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY" \
  --get --data-urlencode "limit=100"

{
  "data": [
    {
      "id": "8f2c1b04-0d5a-4b7e-9f31-6ad2c0e77a51",
      "restaurantId": "restaurant-1",
      "collection": "deliveries",
      "deleted": false,
      "capturedAt": "1787932805120",
      "receivedAt": "1787932911004",
      "sequence": "88",
      "data": {
        "timestamp": "1787932800000",
        "isCompliant": false,
        "supplierDeliveriesId": "supplier-7",
        "temperatureRecords": [
          { "product": "Poulet fermier", "lotNumber": "L2291", "value": 6.4, "unit": "C" }
        ],
        "nonComplianceReasons": ["Température trop élevée"],
        "correctiveActions": ["Produit refusé"],
        "commentary": null
      }
    }
  ],
  "nextCursor": null
}

Temperatures are always Celsius. No time range here: you walk the collection, filter on data.timestamp if you want a week, and keep id to reconcile on the next walk. The other collections (temperatures, cooling, cleaning, labels) are walked exactly the same way.

6. Fetch a delivery's photographs

Photographs are the delivery-pictures collection. Each record names its delivery in data.deliveryId, and the bytes come from its assets:

curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections/delivery-pictures/records" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY" \
  --get --data-urlencode "limit=100"

curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections/delivery-pictures/records/$PICTURE_ID/assets" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY"

The second call answers signed URLs valid for fifteen minutes; download the bytes with no Authorization header. It needs the delivery-pictures:read scope. If your key has only deliveries:read, the deliveries answer and the photographs answer 403. That is the grant doing its job, and the fix is for the customer to issue a key with both.

7. Handle the two failures you will actually meet

404: the restaurant is not on your key, or the record does not exist. The two are deliberately indistinguishable: the API does not confirm that a restaurant exists to a caller who cannot see it.

403: the restaurant is on your key, but the scope this endpoint needs is not.

Every error is a problem document, never an HTML page, and carries a requestId worth quoting if you write to us.

Where next

• Getting a key: the request checklist, and how to change a key later.
• Authentication: scopes, rotation, what a key can and cannot do.
• Pagination: the cursor, and how to keep a copy up to date.
• Deliveries: every field of a goods-in check and its photographs.
• Collections & records: all twenty-six record types, and the envelope they share.
• MCP: the same data inside an AI client, in about three minutes.