Authentication
Log in with email and password to get a Bearer token, then send it in the Authorization header of every request.
POST https://qrmenu.landoftemplates.com/api/v1/auth/login
{"email":"owner@restaurant.com","password":"secret","device_name":"iPhone"}
→ {"success":true,"data":{"token":"…","user":{…},"subscription":{…}}}
GET https://qrmenu.landoftemplates.com/api/v1/auth/me
Authorization: Bearer {token}
Accept-Language: ar
Response format
{
"success": true,
"message": "",
"data": { … },
"meta": {"total":120,"page":1,"pages":6,"per_page":20}
}
// errors: 401 login, 402 plan, 403 permission,
// 404 not found, 422 validation, 429 rate limit
Send ?lang=ar or the Accept-Language header to get translated content.
Example: place an order from the customer app
POST https://qrmenu.landoftemplates.com/api/v1/menu/{restaurant-slug}/orders
Content-Type: application/json
{
"branch_id": 1, "type": "delivery", "customer_name": "Ahmed", "customer_phone": "010…", "address": "…",
"payment_method": "m1", // "m{id}" manual method, or "paymob" / "paypal"
"items": [
{"item_id": 5, "size_id": 2, "addons": [7, 8], "withouts": [9], "qty": 2, "note": "well done"}
]
}
→ 201 {"data":{"order":{…},"payment_url":null,"next_url":"…/order/A7K29QX"}}
Public endpoints
root (1)
| GET | / |
config (1)
| GET | /config |
languages (1)
| GET | /languages/{code}/strings |
plans (1)
| GET | /plans |
menu (3)
| GET | /menu/{slug} | |
| GET | /menu/{slug}/payment-methods | |
| POST | /menu/{slug}/orders |
orders (2)
| GET | /orders/track/{code} | |
| POST | /orders/track/{code}/proof |
auth (3)
| POST | /auth/login | |
| POST | /auth/register | |
| POST | /auth/forgot |
Logged-in user
auth (3)
| POST | /auth/logout | |
| GET | /auth/me | |
| PUT | /auth/me |
Client (restaurant) endpoints
dashboard (1)
| GET | /dashboard | dashboard.view |
restaurants (7)
| GET | /restaurants | |
| POST | /restaurants | restaurants.manage |
| GET | /restaurants/{id} | |
| PUT | /restaurants/{id} | restaurants.manage |
| PATCH | /restaurants/{id} | restaurants.manage |
| POST | /restaurants/{id} | restaurants.manage |
| DELETE | /restaurants/{id} | restaurants.manage |
branches (7)
| GET | /branches | |
| POST | /branches | branches.manage |
| GET | /branches/{id} | |
| PUT | /branches/{id} | branches.manage |
| PATCH | /branches/{id} | branches.manage |
| POST | /branches/{id} | branches.manage |
| DELETE | /branches/{id} | branches.manage |
categories (7)
| GET | /categories | |
| POST | /categories | menu.manage |
| GET | /categories/{id} | |
| PUT | /categories/{id} | menu.manage |
| PATCH | /categories/{id} | menu.manage |
| POST | /categories/{id} | menu.manage |
| DELETE | /categories/{id} | menu.manage |
items (8)
| GET | /items | |
| POST | /items | menu.manage |
| GET | /items/{id} | |
| PUT | /items/{id} | menu.manage |
| PATCH | /items/{id} | menu.manage |
| POST | /items/{id} | menu.manage |
| POST | /items/{id}/availability | menu.manage |
| DELETE | /items/{id} | menu.manage |
orders (6)
| GET | /orders | orders.view |
| GET | /orders/poll | orders.view |
| GET | /orders/{id} | orders.view |
| POST | /orders/{id}/status | orders.manage |
| PUT | /orders/{id}/status | orders.manage |
| POST | /orders/{id}/payment | orders.manage |
payment-methods (6)
| GET | /payment-methods | payments.manage |
| POST | /payment-methods | payments.manage |
| PUT | /payment-methods/{id} | payments.manage |
| PATCH | /payment-methods/{id} | payments.manage |
| POST | /payment-methods/{id} | payments.manage |
| DELETE | /payment-methods/{id} | payments.manage |
gateways (2)
| PUT | /gateways/{slug} | payments.manage |
| POST | /gateways/{slug} | payments.manage |
webhooks (9)
| GET | /webhooks/events | webhooks.manage |
| GET | /webhooks | webhooks.manage Plan: webhooks |
| POST | /webhooks | webhooks.manage Plan: webhooks |
| PUT | /webhooks/{id} | webhooks.manage Plan: webhooks |
| PATCH | /webhooks/{id} | webhooks.manage Plan: webhooks |
| POST | /webhooks/{id} | webhooks.manage Plan: webhooks |
| DELETE | /webhooks/{id} | webhooks.manage Plan: webhooks |
| GET | /webhooks/{id}/deliveries | webhooks.manage Plan: webhooks |
| POST | /webhooks/{id}/test | webhooks.manage Plan: webhooks |
pixels (6)
| GET | /pixels | pixels.manage Plan: pixels |
| POST | /pixels | pixels.manage Plan: pixels |
| PUT | /pixels/{id} | pixels.manage Plan: pixels |
| PATCH | /pixels/{id} | pixels.manage Plan: pixels |
| POST | /pixels/{id} | pixels.manage Plan: pixels |
| DELETE | /pixels/{id} | pixels.manage Plan: pixels |
permissions (1)
| GET | /permissions | roles.manage |
roles (6)
| GET | /roles | roles.manage |
| POST | /roles | roles.manage |
| PUT | /roles/{id} | roles.manage |
| PATCH | /roles/{id} | roles.manage |
| POST | /roles/{id} | roles.manage |
| DELETE | /roles/{id} | roles.manage |
staff (6)
| GET | /staff | users.manage |
| POST | /staff | users.manage |
| PUT | /staff/{id} | users.manage |
| PATCH | /staff/{id} | users.manage |
| POST | /staff/{id} | users.manage |
| DELETE | /staff/{id} | users.manage |
logs (1)
| GET | /logs | logs.view |
subscription (1)
| GET | /subscription | subscription.manage |
invoices (4)
| GET | /invoices | subscription.manage |
| POST | /invoices | subscription.manage |
| POST | /invoices/{id}/pay | subscription.manage |
| POST | /invoices/{id}/proof | subscription.manage |
api-tokens (3)
| GET | /api-tokens | api.manage Plan: api_access |
| POST | /api-tokens | api.manage Plan: api_access |
| DELETE | /api-tokens/{id} | api.manage |
Platform admin endpoints
admin/dashboard (1)
| GET | /admin/dashboard | admin.dashboard |
admin/tenants (5)
| GET | /admin/tenants | tenants.view |
| GET | /admin/tenants/{id} | tenants.view |
| PUT | /admin/tenants/{id} | tenants.manage |
| PATCH | /admin/tenants/{id} | tenants.manage |
| POST | /admin/tenants/{id}/subscription | tenants.manage |
admin/plans (6)
| GET | /admin/plans | plans.manage |
| POST | /admin/plans | plans.manage |
| PUT | /admin/plans/{id} | plans.manage |
| PATCH | /admin/plans/{id} | plans.manage |
| POST | /admin/plans/{id} | plans.manage |
| DELETE | /admin/plans/{id} | plans.manage |
admin/invoices (3)
| GET | /admin/invoices | invoices.view |
| POST | /admin/invoices/{id}/approve | invoices.review |
| POST | /admin/invoices/{id}/reject | invoices.review |
admin/settings (3)
| GET | /admin/settings | settings.manage |
| PUT | /admin/settings | settings.manage |
| PATCH | /admin/settings | settings.manage |
admin/languages (7)
| GET | /admin/languages | languages.manage |
| POST | /admin/languages | languages.manage |
| PUT | /admin/languages/{code} | languages.manage |
| PATCH | /admin/languages/{code} | languages.manage |
| GET | /admin/languages/{code}/strings | languages.manage |
| PUT | /admin/languages/{code}/strings | languages.manage |
| PATCH | /admin/languages/{code}/strings | languages.manage |
admin/email-templates (3)
| GET | /admin/email-templates | emails.manage |
| PUT | /admin/email-templates/{id} | emails.manage |
| PATCH | /admin/email-templates/{id} | emails.manage |
admin/payment-methods (6)
| GET | /admin/payment-methods | gateways.manage |
| POST | /admin/payment-methods | gateways.manage |
| PUT | /admin/payment-methods/{id} | gateways.manage |
| PATCH | /admin/payment-methods/{id} | gateways.manage |
| POST | /admin/payment-methods/{id} | gateways.manage |
| DELETE | /admin/payment-methods/{id} | gateways.manage |
admin/gateways (2)
| PUT | /admin/gateways/{slug} | gateways.manage |
| POST | /admin/gateways/{slug} | gateways.manage |
admin/webhooks (9)
| GET | /admin/webhooks/events | webhooks.manage |
| GET | /admin/webhooks | webhooks.manage |
| POST | /admin/webhooks | webhooks.manage |
| PUT | /admin/webhooks/{id} | webhooks.manage |
| PATCH | /admin/webhooks/{id} | webhooks.manage |
| POST | /admin/webhooks/{id} | webhooks.manage |
| DELETE | /admin/webhooks/{id} | webhooks.manage |
| GET | /admin/webhooks/{id}/deliveries | webhooks.manage |
| POST | /admin/webhooks/{id}/test | webhooks.manage |
admin/pixels (6)
| GET | /admin/pixels | pixels.manage |
| POST | /admin/pixels | pixels.manage |
| PUT | /admin/pixels/{id} | pixels.manage |
| PATCH | /admin/pixels/{id} | pixels.manage |
| POST | /admin/pixels/{id} | pixels.manage |
| DELETE | /admin/pixels/{id} | pixels.manage |
admin/permissions (1)
| GET | /admin/permissions | roles.manage |
admin/roles (6)
| GET | /admin/roles | roles.manage |
| POST | /admin/roles | roles.manage |
| PUT | /admin/roles/{id} | roles.manage |
| PATCH | /admin/roles/{id} | roles.manage |
| POST | /admin/roles/{id} | roles.manage |
| DELETE | /admin/roles/{id} | roles.manage |
admin/staff (6)
| GET | /admin/staff | users.manage |
| POST | /admin/staff | users.manage |
| PUT | /admin/staff/{id} | users.manage |
| PATCH | /admin/staff/{id} | users.manage |
| POST | /admin/staff/{id} | users.manage |
| DELETE | /admin/staff/{id} | users.manage |
admin/logs (1)
| GET | /admin/logs | logs.view |
Webhooks
Each request is a JSON POST signed with HMAC-SHA256 using your secret in the X-Webhook-Signature header. Failed deliveries are retried up to 5 times.
tenant.registeredtenant.updatedinvoice.proof_uploadedinvoice.rejecteduser.createdorder.createdorder.status_updatedorder.paidorder.cancelledorder.payment_proof_uploadeditem.createditem.updateditem.deletedcategory.createdcategory.updatedcategory.deletedrestaurant.createdrestaurant.updatedbranch.createdbranch.updatedsubscription.activatedsubscription.expiringsubscription.expiredinvoice.createdinvoice.paid
POST https://your-server.com/hook
X-Webhook-Event: order.created
X-Webhook-Signature: sha256=HMAC_SHA256(body, secret)
{"id":"evt_…","event":"order.created","created_at":"…","tenant_id":1,"data":{ order … }}