iRetail PRO
Русский Get a key
Menu

iRetail PRO guest listener 1.0.0-m10

8 operations

← All documentation · Source: contracts openapi/guest-v1.yaml at 8000474.

What the node serves guests on its second listener, off by default (IRETAIL_GUEST_LISTEN): the menu page of a table's QR token, its theme, photos and assets, and the guest's own orders. It carries no staff route at all: no /v1, /graphql, /mcp or event path exists on it. A malformed, unknown or retired token, or the token of a table the store's license locks (spec/LICENSE.md, The restaurant's three places), answers the same 404 on every /t/{token} route. Every answer carries a strict Content-Security-Policy and asks for nothing from another origin; an order needs the guest_session cookie the page sets, Content-Type application/json and, when IRETAIL_GUEST_ORIGIN is set, an Origin equal to it. Rules: spec/RESTAURANT.md (The guest menu; The guest listener).

guest 8 operations

  • GET /healthz For a proxy's health check; says nothing else.
  • GET /t/{token} The menu page of the token's table, rendered by the node as HTML with a small script; sets guest_session when absent.
  • GET /t/{token}/theme.css The store's theme as a style sheet (colors, font, layout).
  • GET /t/{token}/photos/{photo_id} A photo a menu shown at the token's table uses; any other photo is 404.
  • GET /assets/{file} The page's script, style sheet and bundled fonts, named by their hash; Cache-Control public, max-age=31536000, immutable.
  • GET /t/{token}/orders The orders this session sent from this table, newest first, at most 20.
  • POST /t/{token}/orders A guest order, waiting for a person to confirm it into the table's check or refuse it. Checked in this order: the address's limit, the token, the table's limit, the session's pending orders, the bounds, then each line.
  • GET /t/{token}/orders/{id} One order this session sent from this table; any other order is 404.