QR ordering

QR ordering, waitlist and feedback

The unauthenticated guest surface. These routes are called from a diner’s phone, so there is no API key: the QR token or the restaurant slug in the path is what scopes the request, and the order routes additionally assert that the order belongs to the token’s own table.

Resolve a QR token

GET

/public/qr/{token} Escopo: public (no key)

Resolves the token printed on a table code into the QR record and the restaurant menu categories behind it. This is the first call the guest flow makes after a scan: it establishes which restaurant, which table and which ordering type (dine-in or takeout) the session belongs to.

Parâmetros de caminho

tokenstringObrigatório

Token encoded in the QR code.

Requisição

curl 'https://api.tablezio.com/public/qr/4f8c2b1a9d'

Get the menu for a QR token

GET

/public/qr/{token}/menu Escopo: public (no key)

Returns the live menu for the token, with the kitchen station attached to each item. It reads the same menu records the POS and the online menu read, so an item marked unavailable is unavailable here in the same request.

Parâmetros de caminho

tokenstringObrigatório

Token encoded in the QR code.

Requisição

curl 'https://api.tablezio.com/public/qr/4f8c2b1a9d/menu'

Place an order from a QR code

POST

/public/qr/{token}/orders Escopo: public (no key)

Creates a self-service order for the table the token belongs to. Prices and item names are not taken from the request: the server looks each menu item up by id and uses its stored price and name, so a tampered payload cannot change what a dish costs. Each item is routed to the station configured on its category, defaulting to the kitchen.

Parâmetros de caminho

tokenstringObrigatório

Token encoded in the QR code.

Parâmetros do corpo

itemsobject[]Obrigatório

Each with menuItemId, quantity, and optional modifiers and notes.

customerNamestringOpcional

Name shown to the staff for this order.

notesstringOpcional

Free-text note for the whole order.

Requisição

curl -X POST 'https://api.tablezio.com/public/qr/4f8c2b1a9d/orders' \
  -H 'Content-Type: application/json' \
  -d '{"customerName":"Ana","items":[{"menuItemId":"5a1b2c3d4e5f6a7b8c9d0e1f","quantity":2}]}'

Add items to an open QR order

POST

/public/qr/{token}/orders/{orderId}/items Escopo: public (no key)

Appends items to an order already open on that table — the second round, rather than a second order. Before appending, the service asserts the order belongs to this token’s table, which is what stops a diner from adding items to a neighbouring bill.

Parâmetros de caminho

tokenstringObrigatório

Token encoded in the QR code.

orderIdstringObrigatório

Order opened from the same token.

Parâmetros do corpo

itemsobject[]Obrigatório

Each with menuItemId, quantity, and optional modifiers and notes.

Requisição

curl -X POST 'https://api.tablezio.com/public/qr/4f8c2b1a9d/orders/507f1f77bcf86cd799439011/items' \
  -H 'Content-Type: application/json' \
  -d '{"items":[{"menuItemId":"5a1b2c3d4e5f6a7b8c9d0e1f","quantity":1}]}'

Read the status of a QR order

GET

/public/qr/{token}/orders/{orderId} Escopo: public (no key)

Returns the current state of an order placed from this token, so the guest can follow it from their phone without asking a member of staff. The same table check as the append route applies: only the order tied to this token’s table is exposed.

Parâmetros de caminho

tokenstringObrigatório

Token encoded in the QR code.

orderIdstringObrigatório

Order opened from the same token.

Requisição

curl 'https://api.tablezio.com/public/qr/4f8c2b1a9d/orders/507f1f77bcf86cd799439011'

Read the online waitlist settings

GET

/public/restaurants/{slug}/waitlist Escopo: public (no key)

Returns what a join page needs: restaurant branding, whether the venue is open right now (from its configured opening hours), the largest party accepted online, the owner’s short message, how many parties are waiting with an estimated wait, and which notification channels (email / SMS) are available. Responds 404 with code WAITLIST_DISABLED when the owner has not switched the online waitlist on, and 403 with WAITLIST_NOT_IN_PLAN when the plan does not include it.

Parâmetros de caminho

slugstringObrigatório

Restaurant slug, the same one used by tablezio.com/r/{slug}.

Requisição

curl 'https://api.tablezio.com/public/restaurants/casa-pepe/waitlist'

Join the waitlist

POST

/public/restaurants/{slug}/waitlist/join Escopo: public (no key)

Adds a party to the restaurant’s live waitlist (it appears in the dashboard tagged “Online”). Requires a name, the party size, a phone and/or an email, and consent to be contacted. Refused outside opening hours (WAITLIST_CLOSED), above the venue’s party cap (WAITLIST_PARTY_TOO_LARGE) or when the same phone/email is already waiting (409 WAITLIST_ALREADY_JOINED). Returns a signed status token — keep it: it is the only handle to the entry.

Parâmetros de caminho

slugstringObrigatório

Restaurant slug, the same one used by tablezio.com/r/{slug}.

Requisição

curl -X POST 'https://api.tablezio.com/public/restaurants/casa-pepe/waitlist/join' \
  -H 'Content-Type: application/json' \
  -d '{"guestName":"Ana","partySize":2,"phone":"+34600000000","consent":true}'

Check a waitlist position

GET

/public/waitlist/{token} Escopo: public (no key)

Returns the party’s state (waiting, notified, seated, cancelled or expired), its position, the parties ahead and an estimated wait in minutes (always an estimate). The token is an HMAC-signed handle to one entry: a tampered or unknown token answers 404 WAITLIST_ENTRY_NOT_FOUND, so entries cannot be enumerated.

Parâmetros de caminho

tokenstringObrigatório

Token returned by the join endpoint.

Requisição

curl 'https://api.tablezio.com/public/waitlist/{token}'

Leave the waitlist

POST

/public/waitlist/{token}/leave Escopo: public (no key)

Removes the party from the queue (the entry is kept as cancelled so staff can see it) and returns the updated status. Answers 409 WAITLIST_NOT_ACTIVE once the party has been seated or already left.

Parâmetros de caminho

tokenstringObrigatório

Token returned by the join endpoint.

Requisição

curl -X POST 'https://api.tablezio.com/public/waitlist/{token}/leave'

Submit guest feedback

POST

/public/restaurants/{slug}/feedback Escopo: public (no key)

Records feedback against the restaurant identified by slug. Because it lands in the same feedback records the platform uses internally, a comment collected from a QR page is visible in the same place as one collected at the table.

Parâmetros de caminho

slugstringObrigatório

Restaurant slug.

Requisição

curl -X POST 'https://api.tablezio.com/public/restaurants/casa-pepe/feedback' \
  -H 'Content-Type: application/json' \
  -d '{"rating":5,"comment":"Great service"}'

Plan catalogue

GET

/public/pricing Escopo: public (no key)

Returns the plans on offer, in euros per month, straight from the same catalogue the pricing page renders and checkout charges from — so it cannot disagree with what you are quoted. It is a platform-level endpoint, not a restaurant one. Plans not currently sold are omitted. What you are actually billed still depends on your account: read this as the public price list, not as a billing API.

Requisição

curl 'https://api.tablezio.com/public/pricing'

Contact form

POST

/public/contact Escopo: public (no key)

Submits the marketing contact form. It requires a valid Turnstile token, which is the same bot check the form on tablezio.com uses; a request without one is rejected before any mail is sent.

Parâmetros do corpo

namestringObrigatório

Sender name.

emailstringObrigatório

Reply-to address.

restaurantNamestringOpcional

Restaurant the enquiry is about.

messagestringObrigatório

The enquiry itself.

turnstileTokenstringObrigatório

Cloudflare Turnstile token. Validated server-side against the caller IP.

langstringOpcional

Language the notification email is sent in.

Requisição

curl -X POST 'https://api.tablezio.com/public/contact' \
  -H 'Content-Type: application/json' \
  -d '{"name":"Ana","email":"[email protected]","message":"Hi","turnstileToken":"0.xyz"}'