Reference
API reference
Every endpoint an integration can call, with its method, its credentials and where it is explained.
The full integration surface on one page. Endpoints not listed here belong to the dashboard, take a signed-in session, and are not part of the supported API.
- Base URL
- The host your customer's dashboard runs on
- Key header
- X-API-Key
- Organization header
- x-organization-id
Content
/api/content/itemsread_contentPublished items. Send content_type, plus page, limit, search as needed.
/api/content/items/{id}read_contentOne item, with its content type and field definitions.
/api/content/typesread_contentEvery content type in the organization, with its fields.
/api/content/docsread_contentDocumentation generated from this organization's own schema, as JSON.
Explained in Content Management.
Ordering and checkout
These are the versioned contract addresses, which is what a storefront calls and what the client script names for you. Each also answers where it always did — the quote at /api/public/{organizationId}/quote, and the online checkout at /api/online-ordering/checkout — and those keep working while promising nothing about their shape.
/api/client/v1/{organizationId}/quotePublicWhat a basket costs: items, fees, the delivery fee, discounts and tax, plus whether it can be ordered at all. The call a cart makes on every change.
/api/client/v1/{organizationId}/checkoutPublicOnline payment. Pass success_url and cancel_url. Returns a Stripe URL. The only checkout address a browser can reach. The client names it checkout.
/api/online-ordering/checkoutcreate_ordersPay in person. Send custom_payment_method_id. Creates the order immediately as unpaid. The client names it checkoutInPerson and sends your key to it — the one ordering call it does; through checkout the same basket arrives without a key and is refused.
/api/public/{organizationId}/organizationPublicBusiness details and opening hours. Needs no key — see Organization.
/api/organization-profileadmin, owner, managerThe full business profile, including unpublished fields. Dashboard only; API keys are refused.
/api/client/v1/{organizationId}/payment-methodsPublicActive online methods and pay-in-person methods.
/api/client/v1/{organizationId}/feesPublicActive order fees, in display order. The catalogue, including the optional and variable ones a quote does not list until they are applied.
/api/client/v1/{organizationId}/restaurantPublicFulfillment types, preparation times, the delivery area summary and the tax configuration.
/api/client/v1/{organizationId}/promotions/previewPublicWhat a discount code is worth on the items alone. For checking a code before there is a basket to quote.
/api/client/v1/{organizationId}/restaurant/delivery-checkPublicWhether one address can be delivered to, with no basket involved. For an address field that validates before a cart exists; the quote answers this and the price together once there is one.
/api/ordersread_ordersOrders with their line items. Filter by status and user_id.
/api/orderswrite_ordersCreate an order directly. For back-office integrations, not storefronts.
Explained in Online Ordering, Restaurant Ordering and Promotions.
Address
/api/public/{organizationId}/address/suggest?q=PublicAddress suggestions, already shaped for fulfillment.address.
/api/public/{organizationId}/address/lookup?id=PublicThe full address for a suggestion id. Optional, kept for older integrations.
Reservations
/api/reservation-settingsread_reservation_settingsThe six fields a booking form follows: opening hours with their exceptions, slot configuration, party size cap, capacity, whether a booking waits for approval, and calendar_timezone.
/api/reservation-typesread_reservation_settingsThe reservation types, each with its slug, its booking limits and the fields its form asks for.
/api/client/v1/{organizationId}/reservations/open-slotsPublicWhich slots still have room on one day. Takes date, and optionally party_size and reservation_type_slug.
/api/reservation-settingswrite_reservation_settingsChange those settings. Not something a booking widget should hold.
/api/reservationsread_reservationsExisting reservations. Filter by start_date, end_date, reservation_type_slug.
/api/reservationswrite_reservationsCreate a reservation. Send booking_source: "website" from a public widget.
/api/reservations/{id}read_reservationsOne reservation.
/api/reservations/{id}write_reservationsUpdate a reservation. A moved start is held to the same rules as a new one, and booking_source is ignored. A key cannot confirm, decline or cancel: its status is ignored, and so are internal_notes, rejection_reason, resource_ids and quarantined_at — those are the staff's. With nothing left to change, it changes nothing and answers the reservation as it stands.
Explained in Reservations.
Bookings
/api/client/v1/{organizationId}/bookings/hoursPublicPer day, when the venue takes a booking, and whether it takes requests at all. Not which times are free.
/api/client/v1/{organizationId}/bookings/open-slotsPublicPer day, the start times still free for an appointment of duration minutes. Times only, nothing about who booked.
/api/bookingsread_bookingsBookings for the organization, paginated.
/api/bookings/{id}read_bookingsOne booking, with its status.
/api/bookingswrite_bookingsCreate a booking and send the confirmation email.
Explained in Bookings.
Contact form
/api/contact-formcontact_form_submitStore a submission and notify the organization.
/api/contact-formcontact_form_manageSubmissions for the organization, paginated.
/api/contact-form/{id}contact_form_manageChange the status: new, read, replied or archived.
/api/contact-form/{id}contact_form_manageDelete a submission and its replies.
/api/contact-form/{id}/repliescontact_form_manageThe reply thread for one submission.
/api/contact-form/{id}/repliescontact_form_manageReply by email and record it. Moves the submission to replied.
Explained in Contact Form. Everything here but the submit is a back office's: not in the manifest and not in @cnter/client, so it is called by path with a contact_form_manage key from a server.
Media
/api/public/video/{videoId}/thumbnailPublicPoster frame for a video field, as an ordinary image.
/embed/{videoId}PublicThe video player. Use in an iframe, without query parameters.
Explained in Video.
Legacy
/api/v1/productsPublicGone. The product catalog moved into Content Management in August 2025; this endpoint answers 410 with code RESOURCE_GONE to every caller. Read the catalog at /api/content/items?content_type=<slug> instead.
Shared behaviour
Pagination, the response envelope, date formats, unknown-field handling and CORS are the same everywhere. They are in Conventions, and the statuses are in Errors.