Generated from the live OpenAPI 3.1 spec. Base URL: https://api.trueplate.ai/v1. Every endpoint path begins with /partner and is printed in full on the endpoint itself, so base plus path is the URL you call. The navigation drops the prefix to keep the tree readable. Authenticate with a secret key (Bearer).
Keys
GETInspect the calling key
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
The spec declares no additional key scope for this operation.
Request
This request has no parameters.
Responses
200Key metadata, scopes, and holder.
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
429Per-key rate limit exceeded: slow down and retry.
Restaurant keys return exactly their own restaurant. Integrator keys return every restaurant with an ACTIVE owner-approved grant whose subscription is currently entitled, cursor-paginated over grant creation order.
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
menu:read
Request
Query parameters
cursorstringoptional
limitintegeroptionaldefault 100
Responses
200One page of authorized restaurants.
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
429Per-key rate limit exceeded: slow down and retry.
Sections, items, option groups: the same serialization TruePlate's own menu pages use. Asset URLs are signed for your key. Supports conditional requests: the ETag covers menu CONTENT (not URL signatures); a 304 means your cached copy is current, though its signed URLs may need refreshing.
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
menu:read
Request
Path parameters
restaurantIdstringrequired
Query parameters
langstringoptional
Translated menu, when the restaurant supports the language.
Header parameters
If-None-Matchstringoptional
Responses
200The menu. ETag header identifies this content version.
304Menu content unchanged since the presented ETag.
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
404Restaurant not found.
429Per-key rate limit exceeded: slow down and retry.
Response body
dataMenurequired
restaurantobjectrequired
sectionsarray of objectrequired
totalItemsintegerrequired
promotionsarray of objectrequired
Active promotion banners (display metadata; shape mirrors the public menu).
One diner turn against the restaurant's grounded menu concierge, streamed as Server-Sent Events (meta, delta, cards, detail, proposal, done, error, the exact protocol TruePlate's own menu pages consume). Requires the concierge:chat key scope AND the restaurant's AI Concierge add-on; messages meter into the restaurant's concierge quota (one quota across every surface). There is no raw-completion mode, no prompt override, and no model parameter: the assistant only answers about this restaurant's menu. TEST keys stream a deterministic sandbox provider. Your integration MUST keep the AI disclosure from the meta event visible to end users (EU AI Act Article 50 follows the deployment surface).
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
concierge:chat
Request
Path parameters
restaurantIdstringrequired
Request body
application/json required
messagestringrequired
conversationIdstring
Continue a prior thread (returned in meta).
languagestring
deviceFpstring
Opaque end-user fingerprint for per-device rate limiting.
passportobject
End-user dietary context, processed per-request only (never stored).
Responses
200text/event-stream of the turn: meta, then any number of delta/cards/detail, then done or error.
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
404Restaurant not found.
429Per-key rate limit exceeded: slow down and retry.
curl-X POST https://api.trueplate.ai/v1/partner/restaurants/RESTAURANT_ID/concierge/chat\-H"Authorization: Bearer tp_sk_live_YOUR_KEY"\-H"Content-Type: application/json"\-d'{"message":"string","conversationId":"string","language":"string","deviceFp":"string","passport":{"allergies":["string"],"diets":["string"],"dislikes":["string"]}}'
200Response text/event-stream
text/event-stream of the turn: meta, then any number of delta/cards/detail, then done or error.
Items
GETItem listing for incremental sync
Ordered updatedAt ASC, id ASC. Each sweep covers a FIXED window (syncWindowStart, syncWindowEnd] frozen on the first page, so pagination converges even while items keep changing: feed meta.syncWindowEnd back as the next poll's updatedAfter for gapless, overlap-free polling (or subscribe to webhooks and skip polling). Cursors are signed and bound to the filters that issued them: reuse with different filters is a 400 cursor_filter_mismatch. status cannot be combined with updatedAfter: a status-filtered incremental feed would silently miss items that leave the filtered status; sync unfiltered and filter client-side. The FIRST page of an incremental poll (updatedAfter set, no cursor) also carries deleted, tombstones for items hard-deleted since that instant, so a poller converges without webhooks. Tombstones are retained for a configured window (default 90 days); when your updatedAfter predates it, or the deletion list overflows, the response says so via meta.fullResyncRequired, do a full resync (list without updatedAfter).
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
menu:read
Request
Path parameters
restaurantIdstringrequired
Query parameters
updatedAfterstring (date-time)optional
Return items updated strictly after this instant. Pass the previous poll's meta.syncWindowEnd.
cursorstringoptional
Signed cursor from the previous page's meta.nextCursor. Must be combined with the same filters it was issued with.
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
assets:read
Request
Path parameters
itemIdstringrequired
Responses
200Item detail. assets is null for items without any 3D capture.
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
404Item not found.
429Per-key rate limit exceeded: slow down and retry.
Response body
dataItemDetailrequired
idstringrequired
slugstringrequired
namestringrequired
descriptionstring | nullrequired
pricenumber | nullrequired
DEPRECATED: menu price in MAJOR units (e.g. dollars). Use priceCents. Kept for compatibility.
priceCentsinteger | nullrequired
Menu price in integer MINOR units (cents): the canonical price field.
Signed URLs expire (default 15 minutes). Call this when a stored URL 403s, or ahead of time for long sessions. TTL is capped at 24 hours.
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
assets:read
Request
Path parameters
itemIdstringrequired
Request body
application/json optional
ttlSecondsinteger
Responses
200Fresh signed URLs.
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
404Item not found.
429Per-key rate limit exceeded: slow down and retry.
Response body
dataobjectrequired
POST/partner/items/{itemId}/asset-urls
1
2
3
4
curl-X POST https://api.trueplate.ai/v1/partner/items/ITEM_ID/asset-urls\-H"Authorization: Bearer tp_sk_live_YOUR_KEY"\-H"Content-Type: application/json"\-d'{"ttlSeconds":0}'
Restaurant keys manage the restaurant's endpoints; integrator keys manage their organization's. Requires the webhooks:manage scope.
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
webhooks:manage
Request
This request has no parameters.
Responses
200Registered endpoints (signing secrets are never re-shown).
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
429Per-key rate limit exceeded: slow down and retry.
The response is the ONLY place the signing secret appears, store it server-side. Send an Idempotency-Key so a retried request replays this response (same endpoint, same secret) instead of creating a duplicate. URLs must be public HTTPS (private-network and redirect-based receivers are rejected). Limit: 10 endpoints per holder.
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
webhooks:manage
Request
Header parameters
Idempotency-Keystringoptional
Retries with the same key (per API key, 24h) replay the original response instead of repeating the operation. Replays carry Idempotency-Replayed: true.
200The endpoint, WITH its one-time signing secret. Replays carry Idempotency-Replayed: true.
400Invalid URL/events, endpoint limit reached, or malformed Idempotency-Key.
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
409idempotency_in_flight: a request with this Idempotency-Key is still executing. idempotency_key_conflict: the key was already used for a different operation or request body.
429Per-key rate limit exceeded: slow down and retry.
PATCHUpdate an endpoint (URL, events, active flag)
Re-enabling a platform-disabled endpoint clears its failure streak. The signing secret is immutable here: rotate it instead.
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
webhooks:manage
Request
Path parameters
idstringrequired
Responses
200Deleted (its delivery history is removed with it).
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
404Endpoint not found (or not yours).
429Per-key rate limit exceeded: slow down and retry.
The new secret appears in this response only and takes effect immediately, deploy it to your receiver first, then rotate. Honors Idempotency-Key like create.
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
webhooks:manage
Request
Path parameters
idstringrequired
Header parameters
Idempotency-Keystringoptional
Retries with the same key (per API key, 24h) replay the original response instead of repeating the operation. Replays carry Idempotency-Replayed: true.
Responses
200The endpoint with its NEW one-time signing secret.
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
404Endpoint not found (or not yours).
409idempotency_in_flight: a request with this Idempotency-Key is still executing. idempotency_key_conflict: the key was already used for a different operation or request body.
429Per-key rate limit exceeded: slow down and retry.
Walk the full retention window with cursor: pass the previous page's nextCursor together with the SAME endpointId/status filters it was issued with.
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Resets the delivery to PENDING and enqueues it afresh (naturally idempotent). The endpoint must be active.
Scopes
Every request authenticates with the apiKey security scheme (http bearer, tp_sk_live_…).
Secret API key from your Developers page. Server-side only: never ship it in an app or web page (that's what publishable keys and the embed viewer are for).
Key scope required for this operation:
webhooks:manage
Request
Path parameters
idstringrequired
Responses
200Requeued.
400The endpoint is disabled: re-enable it first.
401Missing or invalid API key.
403Key type, scope, origin, restaurant authorization, or subscription entitlement rejected the request.
404Delivery not found (or not yours).
429Per-key rate limit exceeded: slow down and retry.
Response body
dataobjectrequired
POST/partner/webhook-deliveries/{id}/redeliver
1
2
curl-X POST https://api.trueplate.ai/v1/partner/webhook-deliveries/ID/redeliver\-H"Authorization: Bearer tp_sk_live_YOUR_KEY"