Making requests

Base URL

https://api.canteenweb.com/api/v1/admin

All endpoints in this reference are relative to that URL. The v1 segment is the API version. Breaking changes, if we ever need them, will ship under a new version and the old one will keep working for a published period. See the changelog.

Required headers

Header	Description	Example
Authorization	Bearer token	Bearer your-access-token
X-CANTEEN-ORGANIZATION	UUID of the organization the request is for	9e11ee05-32a4-4898-8735-5a7f88003409
Accept	Always application/json	application/json

Accept: application/json matters. Without it an error can come back as an HTML page instead of the JSON envelope described in Responses.

Methods

The endpoints available to every token are read only and use GET. Filters go in the query string. Write endpoints (POST, PUT, DELETE) exist on the extended API and take a JSON body with Content-Type: application/json.

Example

curl "https://api.canteenweb.com/api/v1/admin/orders?status=completed" \
  -H "Authorization: Bearer your-access-token" \
  -H "X-CANTEEN-ORGANIZATION: your-org-uuid" \
  -H "Accept: application/json"

Dates and time zones

Every organization has a time zone configured in the backoffice. Date filters such as start_date and end_date are interpreted in that time zone, so 2025-02-12 means the whole of February 12th where the cafeteria is, not in UTC. Timestamps in responses are ISO 8601.

Identifiers

Resources are identified by UUID, never by numeric id. UUIDs are stable and safe to store on your side.

Encoding

Requests and responses are UTF-8. Text fields such as product titles keep accents and other non ASCII characters exactly as entered in the backoffice.