PHP2Shell: Is Your Joomla Site Safe? What to Do Today Introducing Next Boards: Kanban project and task boards for Joomla Next Exams 6.2.0: Exam Studio, six visual question types, exam embeds and six new languages Building the Future of Joomla Extensions
NextSoftware
Next Restaurant — Documentation

Worked example & advice

A worked example

Placing an order end to end, in the order a kiosk would do it:

BASE="https://your-site.example/api/index.php/v1/nextrestaurant"
AUTH="Authorization: Bearer $NR_TOKEN"

# 1. Which branches exist?
curl -s "$BASE/locations" -H "$AUTH" | jq '.data[] | {id, title, currency}'

# 2. What can branch 2 sell right now?
curl -s "$BASE/locations/2/menu" -H "$AUTH" \
  | jq '.data.categories[].items[] | {id, title, price, has_variations}'

# 3. What are the options on item 16?
curl -s "$BASE/locations/2/menu" -H "$AUTH" \
  | jq '.data.categories[].items[] | select(.id == 16) | {variations, modifier_groups}'

# 4. Place the order (201 Created).
curl -s -X POST "$BASE/orders" -H "$AUTH" \
  -H "Content-Type: application/json" \
  -d '{"location_id":2,"items":[{"item_id":16,"variation_id":2,"qty":1}]}' \
  | jq '.data | {order_number, grand_total, status}'

Practical advice

  • Cache the menu, briefly. It changes when staff 86 an item, so a 30–60 second cache keeps the kiosk responsive without selling something the kitchen ran out of ten minutes ago.
  • Re-fetch the menu before submitting a long-lived basket, and re-check the ids you are about to send. A 400 One of the items is no longer available at checkout is the item having gone off sale while the customer was deciding.
  • Retrying is not free. There is no idempotency key, so a retried createOrder that actually succeeded the first time creates a second order. On a timeout, treat the outcome as unknown and reconcile rather than blindly retrying.
  • Use webhooks for "what happened next". The API has no endpoint to read an order back after it is created, so keep the order_number from the response and subscribe to Webhooks for status changes. Polling is the wrong shape here, and there is nothing to poll.

What the API is not

Being explicit avoids disappointment:

  • It is not an admin API. There is no endpoint to edit menu items, manage staff, or change settings. Administration happens in the admin.
  • It is not a reporting API. Reports are read in the admin, or exported as CSV.
  • It cannot read orders back. There is no order-status endpoint. Use webhooks.
  • It does not take payment. Orders arrive unpaid.
  • It does not replace webhooks. For "tell me when something happens", use Webhooks.

Security notes

  • Treat the token as a credential. Anyone holding it can read your menu and place orders.
  • Keep it server-side. See the CORS warning above.
  • Use HTTPS. The token transits on every request.
  • Regenerate on suspicion. One click, and the old token dies immediately.
  • Turn the module off if you're not using it. An unused enabled API is a surface for no benefit.
  • Timestamps are UTC. placed_at and other instants are returned in UTC; convert them with the location's timezone. See Timezones & venue time.

See also

  • Webhooks — outbound events, and the only way to follow an order
  • Apps & Modules — enabling the API module
  • Online Ordering — what an API order becomes
  • Menu — variations, modifier groups and allergens in the admin

All Extensions