Next Restaurant REST API
The public integration surface for Next Restaurant — enough to run a kiosk, a mobile app or a partner ordering front end. It is deliberately narrow: it is not an administration API, not a reporting API, and it does not take payment.
It is off by default. Two switches must both be on: the API module under Apps, and Enable API under Integrations. Then generate the bearer token under Integrations — it is shown once and stored only as a hash.
Totals are always recomputed on the server from the menu records, so a submitted price is ignored. An integration never has to replicate your tax or pricing rules, and a tampered request buys nothing at the wrong price.
Base URL
{protocol}://{host}{basePath}/api/index.php| Variable | Meaning | Example |
|---|---|---|
{protocol} |
Use http only for local development. | https |
{host} |
The host your Joomla site runs on. | your-site.example |
{basePath} |
Empty when Joomla is installed at the domain root. Otherwise the subfolder it is installed in, with a leading slash and no trailing slash — for example /restaurant. | (empty) |
Authentication
Authorization: Bearer <your-api-token>X-Api-Token is accepted as an alternative — Alternative to the bearer scheme, for clients that cannot set Authorization.
The API token generated under Integrations. Shown once at generation and stored only as a SHA-256 hash, so it cannot be recovered — generate a new one if it is lost, which also invalidates the old one immediately.
Keep it server-side. Calling this API from browser JavaScript puts the token in the page where any visitor can read it, and restricting origins does not help: CORS is enforced by browsers, not by the server.
Endpoints
| Method | Operation | Purpose | Group |
|---|---|---|---|
GET |
/v1/nextrestaurant/locations |
List published locations | Locations |
GET |
/v1/nextrestaurant/locations/{locationId}/menu |
The live, orderable menu for a location | Menu |
POST |
/v1/nextrestaurant/orders |
Place an order | Orders |
Webhook events
Outbound events. When something happens in Next Restaurant, an HTTP POST is sent to the endpoints you configure — so another system can react without polling.
Webhooks tell you an order changed; they do not carry the whole order. There is no endpoint to fetch an order back, so keep the response you got when you created it.
| Event | When |
|---|---|
order.placed |
A new order is created, on any channel |
order.updated |
An existing order changes |
order.status_changed |
An order moves to a new status |
order.cancelled |
An order is cancelled, with the reason |
ping |
You press Test webhook — for connectivity checks only |
Errors
| Status | Code | When |
|---|---|---|
401 |
INVALID_TOKEN |
The token is missing, wrong, or none has been generated. |
403 |
MODULE_DISABLED |
This module is disabled. |
403 |
API_DISABLED |
API is disabled |
404 |
UNKNOWN_LOCATION |
No such published location. |
400 |
INVALID_ORDER |
One of the items is no longer available. |
429 |
RATE_LIMITED |
Too many orders from this address — 60 per 5 minutes. No order was created, so the request is safe to retry after a pause. |
500 |
ORDER_FAILED |
The order could not be created. The message is deliberately generic; the detail is in the Joomla log under administrator/logs/. |
See also
- REST API guide — enabling the API, screenshots and a worked end-to-end example