Get credentials, swap them for a token, make your first read, make your first write, learn the error shape. That's the whole story — the rest is just more endpoints.
Standard OAuth2. Standard REST. Standard RFC 7807 errors. No bespoke SDK required.
Andromeda splits reads and writes across two APIs — a Queries API for GET requests, and a Commands API for POST, PUT and DELETE. A third service, the Identity server, issues OAuth2 tokens. All three are accessible on both a test and a production environment.
| Service | Test | 产品ion |
|---|---|---|
| Identity (OAuth2) | test-portal-identity.azurewebsites.net |
portal-identity.azurewebsites.net |
| Queries API (reads) | test-portal-queries-api.azurewebsites.net |
portal-queries-api.azurewebsites.net |
| Commands API (writes) | test-portal-api.azurewebsites.net |
portal-api.azurewebsites.net |
Every integration starts against test. Promotion to production is a config change, not a code change.
电邮 info@androtech.com or book a call. Tell us the use case — reporting, 菜单 automation, loyalty sync, etc. — and we'll issue a non-production organisation with test data.
You get a pair of credentials scoped to your organisation, plus a handful of test locations seeded with products, prices and a stream of synthetic 订单 so you have something realistic to read and write against.
Azure Key Vault, AWS Secrets Manager, 1Password — anything but source control. The secret never needs to appear in browser code; OAuth2 client_credentials is a server-to-server flow.
Standard OAuth2 client_credentials grant. The response is a short-lived JWT signed with our platform certificate — attach it as a Bearer header on every subsequent call.
PROTECT_BLOCK_12_ENDResponse — 200 OK
PROTECT_BLOCK_13_ENDUse it on every call
PROTECT_BLOCK_14_END
Every endpoint is scoped to an organisation. Your organizationId is baked into the token claims — you can only touch your own data. A locations call is the canonical "am I wired up correctly?" first request.
PROTECT_BLOCK_16_ENDResponse — 200 OK
PROTECT_BLOCK_17_ENDKeep the location IDs
PROTECT_BLOCK_18_END
Write endpoints live on the Commands API. The host changes (from *-queries-api to *-portal-api) but the bearer token and the org/location scoping are identical. A 202 means accepted and queued for propagation.
PROTECT_BLOCK_21_ENDResponse — 202 Accepted
PROTECT_BLOCK_22_END
If a required field is missing, mutually-exclusive filters are supplied together, or a date range is invalid, you get a ProblemDetails body describing what's wrong and a traceId you can quote to our helpdesk.
PROTECT_BLOCK_25_ENDCommon statuses
PROTECT_BLOCK_26_END
You now have a working token, you can read, you can write, you understand the error shape. Every remaining problem is "which endpoints do I need?" — pick the area that matches what you're building.
产品s, modifiers, option groups, prices, allergens and deals.
Live 订单, history, detail, search, lifecycle and refunds.
Customer profiles, loyalty tier progress, marketing segments, vouchers.
Metrics, intraday, sales-by-channel/hour/product, BI export.
Webhooks, external stores, courier providers, payment devices.
The full developer platform page, with headline examples.
电邮 us with what you're building and we'll send a test client, seeded data, and a technical contact inside one working day.
Request test access