# Quickstart > From a key to your first records and a delivery photograph in five minutes, with curl. Source: https://developers.backresto.com/en/docs/quickstart You need one thing: a partner key. It already knows which restaurants it was granted, and the API will tell you. ## 1. Get a key Email [contact@backresto.com](mailto:contact@backresto.com?subject=Partner%20API%20key%20request) with your company, the restaurants you need and the scopes you want. We confirm with the restaurant, then send the key to the technical contact you named. [Getting a key](https://developers.backresto.com/en/docs/access) is the full checklist. Sending it complete is what makes the round trip one email rather than four. A key looks like this: ``` brp_hV8kZ2pQ.tW3nR7yL9cF1sB4xJ6mA8dK0gN5vE2uP7hQ3rT1zY6i ``` The half before the dot is a public prefix: it identifies the key in the list on that page and in support conversations, and it is safe to write down. The half after it is the secret, and it appears nowhere but that one screen. ## 2. Store it Put the whole value in your secret manager, as one string, and delete the email it arrived in. Never a repository, never a URL, never a log line. We keep only a digest of the secret, so a lost key means a revocation and a new one. Write to us and both happen the same day. ```bash export BACKRESTO_PARTNER_API_KEY='brp_…' ``` ## 3. Find your restaurant Ask the key which restaurants it reaches, and with which scopes: ```bash curl "https://api.backresto.com/v1/restaurants" \ -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY" ``` ```json { "data": [ { "restaurantId": "restaurant-1", "scopes": ["deliveries:read", "delivery-pictures:read", "temperature-records:read"] } ] } ``` Most keys reach one restaurant. Keep its identifier for the calls below: ```bash export RESTAURANT_ID='restaurant-1' ``` ## 4. See which collections the key opens Every record type, deliveries included, is a [collection](https://developers.backresto.com/en/docs/collections). Ask the key which ones it reaches: ```bash curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections" \ -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY" ``` ```json { "data": [ { "collection": "deliveries", "readScope": "deliveries:read", "description": "Received shadow snapshots for deliveries; not complete primary-store history.", "stateKind": "received-shadow-snapshot", "payloadVersion": 1 } ] } ``` An empty `data` means the key has no collection grants yet. [Ask for the ones you need](https://developers.backresto.com/en/docs/access). ## 5. Walk the deliveries A collection is walked page by page with an opaque cursor. Timestamps are **epoch milliseconds, as strings**: that is the convention across the whole API, never seconds, never ISO 8601. ```bash curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections/deliveries/records" \ -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY" \ --get --data-urlencode "limit=100" ``` ```json { "data": [ { "id": "8f2c1b04-0d5a-4b7e-9f31-6ad2c0e77a51", "restaurantId": "restaurant-1", "collection": "deliveries", "deleted": false, "capturedAt": "1787932805120", "receivedAt": "1787932911004", "sequence": "88", "data": { "timestamp": "1787932800000", "isCompliant": false, "supplierDeliveriesId": "supplier-7", "temperatureRecords": [ { "product": "Poulet fermier", "lotNumber": "L2291", "value": 6.4, "unit": "C" } ], "nonComplianceReasons": ["Température trop élevée"], "correctiveActions": ["Produit refusé"], "commentary": null } } ], "nextCursor": null } ``` Temperatures are always Celsius. No time range here: you walk the collection, filter on `data.timestamp` if you want a week, and keep `id` to reconcile on the next walk. The other collections (temperatures, cooling, cleaning, labels) are walked exactly the same way. ## 6. Fetch a delivery's photographs Photographs are the `delivery-pictures` collection. Each record names its delivery in `data.deliveryId`, and the bytes come from its assets: ```bash curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections/delivery-pictures/records" \ -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY" \ --get --data-urlencode "limit=100" curl "https://api.backresto.com/v1/restaurants/$RESTAURANT_ID/collections/delivery-pictures/records/$PICTURE_ID/assets" \ -H "Authorization: Bearer $BACKRESTO_PARTNER_API_KEY" ``` The second call answers signed URLs valid for fifteen minutes; download the bytes with no `Authorization` header. It needs the `delivery-pictures:read` scope. If your key has only `deliveries:read`, the deliveries answer and the photographs answer `403`. That is the grant doing its job, and the fix is for the customer to issue a key with both. ## 7. Handle the two failures you will actually meet **`404`**: the restaurant is not on your key, or the record does not exist. The two are deliberately indistinguishable: the API does not confirm that a restaurant exists to a caller who cannot see it. **`403`**: the restaurant is on your key, but the scope this endpoint needs is not. Every error is [a problem document](https://developers.backresto.com/en/docs/errors), never an HTML page, and carries a `requestId` worth quoting if you write to us. ## Where next - [Getting a key](https://developers.backresto.com/en/docs/access): the request checklist, and how to change a key later. - [Authentication](https://developers.backresto.com/en/docs/authentication): scopes, rotation, what a key can and cannot do. - [Pagination](https://developers.backresto.com/en/docs/pagination): the cursor, and how to keep a copy up to date. - [Deliveries](https://developers.backresto.com/en/docs/deliveries): every field of a goods-in check and its photographs. - [Collections & records](https://developers.backresto.com/en/docs/collections): all twenty-six record types, and the envelope they share. - [MCP](https://developers.backresto.com/en/docs/mcp): the same data inside an AI client, in about three minutes.