One API for every table, every app.

curl -X POST https://revotab.com/api/v1/auth/login \
  -H "Accept: application/json" -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"your-password","device_name":"Host stand iPad"}'

{
  "token": "12|8yJx…",
  "token_type": "Bearer",
  "account": {
    "id": 7, "kind": "user", "name": "Eleni", "email": "[email protected]",
    "restaurants": [
      { "id": 3, "name": "Taverna Thalassa", "role": "owner",
        "account": { "plan": "pro", "status": "active", "features": ["reservations", "floor_plan", "waitlist", "…"] } }
    ]
  }
}

curl https://revotab.com/api/v1/restaurants/3/reservations?date=2026-11-20 \
  -H "Accept: application/json" \
  -H "Authorization: Bearer 12|8yJx…"

curl -X POST https://revotab.com/api/v1/restaurants/3/reservations \
  -H "Accept: application/json" -H "Content-Type: application/json" \
  -H "Authorization: Bearer 12|8yJx…" \
  -H "Idempotency-Key: 6f1c2a4e-booking-1" \
  -d '{"date":"2026-11-20","time":"20:30","party_size":4,"first_name":"Maria","source":"phone"}'

{
  "message": "Booking K7Q2MZ4P created.",
  "data": { "created": { "id": 812, "code": "K7Q2MZ4P" } }
}

// 1. POST /auth/login answers, for an account with two-factor:
{ "two_factor_required": true, "challenge": "eyJpdiI6…" }

// 2. Send the challenge with the 6-digit code from the authenticator app:
POST /auth/two-factor
{ "challenge": "eyJpdiI6…", "code": "123456", "device_name": "Host stand iPad" }

POST /auth/guest/code    { "email": "[email protected]" }
POST /auth/guest/verify  { "email": "[email protected]", "code": "482913", "device_name": "Maria's iPhone" }
→ { "token": "41|…", "account": { "kind": "guest", … } }

GET /restaurants/3/reservations?date=2026-11-20
{
  "page": "app/Reservations",
  "data": { "date": "2026-11-20", "reservations": [ … ], "shifts": [ … ], "tables": [ … ] }
}

POST /restaurants/3/guests/55/notes   → { "message": "Saved." }
POST /restaurants/3/billing/portal    → { "redirect_url": "https://billing.stripe.com/…" }
POST /public/restaurants/thalassa/reservations (with a deposit)
  → { "redirect_url": "https://checkout.stripe.com/…", "data": { "created": { "code": "K7Q2MZ4P", "deposit_amount": 40 } } }

HTTP/1.1 422 Unprocessable Content
{
  "message": "The party size field must be at least 1.",
  "code": "validation_failed",
  "errors": { "party_size": ["The party size field must be at least 1."] }
}

GET https://revotab.com/api/v1/restaurants/3/changes?since=2026-11-20T19:42:10+00:00
{
  "data": {
    "server_time": "2026-11-20T19:42:25+00:00",
    "reservations": [ … ], "waitlist": [ … ], "orders": [ … ], "reviews": [ … ]
  }
}

POST /me/devices   (POST /guest/devices for guest apps)
{ "platform": "ios", "push_token": "f3c1…", "name": "Host stand iPad", "app_version": "1.0.0" }

POST https://your-system.example.com/revotab
Revotab-Event: reservation.created
Revotab-Delivery: 2b0c0e0a-5a1f-4a5e-9a39-3b6d7f1d2c11
Revotab-Signature: t=1795721530,v1=5f2b…

{ "event": "reservation.created", "created_at": "2026-11-20T19:42:10+00:00",
  "restaurant_id": 3, "data": { "code": "K7Q2MZ4P", "date": "2026-11-20", "time": "20:30", … } }

import crypto from 'node:crypto';

// rawBody: the request body exactly as received (a string or Buffer)
export function isFromRevotab(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  const expected = crypto.createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300; // reject replays
  return fresh && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

function is_from_revotab(string $rawBody, string $header, string $secret): bool
{
    parse_str(str_replace(',', '&', $header), $p);
    $expected = hash_hmac('sha256', $p['t'].'.'.$rawBody, $secret);

    return abs(time() - (int) $p['t']) < 300 && hash_equals($expected, $p['v1'] ?? '');
}

# Generate a typed Dart client from the OpenAPI document
dart pub global activate openapi_generator_cli   # or use openapi-generator
openapi-generator generate -i https://revotab.com/developers/openapi.json \
  -g dart-dio -o packages/revotab_api

final res = await http.get(
  Uri.parse('https://revotab.com/api/v1/me'),
  headers: {
    'Accept': 'application/json',
    'Accept-Language': 'el',          // messages in Greek
    'Authorization': 'Bearer $token',
  },
);
final body = jsonDecode(res.body);
if (res.statusCode >= 400) throw ApiError(body['code'], body['message'], body['errors']);