Quickstart

You need one thing: a partner key. It already knows which restaurants it was granted, and the API will tell you.

1. Get a key

Email contact@backresto.com with your company, the restaurants you need and the scopes you want. We confirm with the restaurant, then send the key to the technical contact you named. Getting a key is the full checklist — sending it complete is what makes the round trip one email rather than four.

A key looks like this:

brp_hV8kZ2pQ.tW3nR7yL9cF1sB4xJ6mA8dK0gN5vE2uP7hQ3rT1zY6i

The half before the dot is a public prefix — it identifies the key in the list on that page and in support conversations, and it is safe to write down. The half after it is the secret, and it appears nowhere but that one screen.

2. Store it

Put the whole value in your secret manager, as one string, and delete the email it arrived in. Never a repository, never a URL, never a log line. We keep only a digest of the secret, so a lost key means a revocation and a new one — write to us and both happen the same day.

export BACKRESTO_PARTNER_API_KEY='brp_…'

3. Find your restaurant

Ask the key which restaurants it reaches, and with which scopes:

curl "https://api.backresto.com/v1/restaurants" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY"

{
  "data": [
    {
      "restaurantId": "restaurant-1",
      "scopes": ["deliveries:read", "delivery-images:read"]
    }
  ]
}

Most keys reach one restaurant. Keep its identifier for the calls below:

export RESTAURANT_ID='restaurant-1'

4. List a week of deliveries

The list endpoint takes an explicit time range, in epoch milliseconds, as strings. That is the convention across the whole API — never seconds, never ISO 8601.

curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/deliveries" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY" \
  --get \
  --data-urlencode "from=1787846400000" \
  --data-urlencode "to=1788451200000" \
  --data-urlencode "limit=25"

{
  "data": [
    {
      "id": "8f2c1b04-0d5a-4b7e-9f31-6ad2c0e77a51",
      "restaurantId": "restaurant-1",
      "occurredAt": "1787932800000",
      "isCompliant": false,
      "supplier": { "id": "supplier-7", "name": "Metro Nord" },
      "temperatureRecords": [
        { "product": "Poulet fermier", "lotNumber": "L2291", "unit": "C", "value": 6.4 }
      ],
      "nonComplianceReasons": ["Température trop élevée"],
      "correctiveActions": ["Produit refusé"],
      "commentary": null,
      "imageCount": 2
    }
  ],
  "nextCursor": null
}

5. Fetch one delivery, and its photographs

curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/deliveries/$DELIVERY_ID" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY"

curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/deliveries/$DELIVERY_ID/images" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY"

The photographs endpoint needs the delivery-images:read scope in addition to deliveries:read. If your key has only the first, the delivery answers and the photographs answer 403 — that is the grant doing its job, and the fix is for the customer to issue a key with both.

6. Read one of the other collections

Everything that is not a delivery — temperatures, cooling, cleaning, labels — is a collection. Ask the key which ones it opens:

curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY"

An empty data means the key has no collection grants yet, which is the normal state of a key issued for deliveries alone — ask for the ones you need. Otherwise, walk one:

curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections/temperature-records/records" \
  -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY" \
  --get --data-urlencode "limit=100"

{
  "data": [
    {
      "id": "3a71f0c8-9d24-4f11-bb0e-77c2e5a41d93",
      "restaurantId": "restaurant-1",
      "collection": "temperature-records",
      "deleted": false,
      "capturedAt": "1788961200000",
      "receivedAt": "1788961318000",
      "sequence": "4192",
      "data": {
        "timestamp": "1788961200000",
        "value": 3.2,
        "unit": "CELSIUS",
        "shift": "MORNING",
        "equipmentId": "equipment-12"
      }
    }
  ],
  "nextCursor": null
}

No time range here: you walk the collection and keep id to reconcile on the next walk.

7. Handle the two failures you will actually meet

404 — the restaurant is not on your key, or the delivery does not exist. The two are deliberately indistinguishable: the API does not confirm that a restaurant exists to a caller who cannot see it.

403 — the restaurant is on your key, but the scope this endpoint needs is not.

Every error is a problem document, never an HTML page, and carries a requestId worth quoting if you write to us.

Where next

• Getting a key — the request checklist, and how to change a key later.
• Authentication — scopes, rotation, what a key can and cannot do.
• Pagination — the cursor, and how to walk a long range.
• Deliveries — every field, and what it means on the shop floor.
• Collections & records — the other twenty-four record types, and the envelope they share.
• MCP — the same data inside an AI client, in about three minutes.