Short answer
EvronDesk has a REST API at https://pos.evrondesk.com/api/v1 with endpoints for the restaurant profile, menu, orders, customers, stock and sales reports. Keys are scoped (for example orders:write or reports:read), order creation is idempotent, and webhooks deliver signed events in real time with automatic retries.
Endpoints
| Method | Path | Scope | What it does |
|---|---|---|---|
| GET | /me | any | Restaurant name, currency, time zone, tax settings, and the key's scopes |
| GET | /menu | menu:read | Categories, items and modifier groups |
| GET / POST | /menu/items | menu:read / menu:write | List or create items |
| PATCH | /menu/items/{id or sku:CODE} | menu:write | Change price, availability (86) and other fields |
| GET / POST | /orders | orders:read / orders:write | List with filters and cursor paging, or create an order |
| GET | /orders/{id or ref:REF} | orders:read | One order with items and payments |
| GET / POST | /customers | customers:read / customers:write | Search, or create (deduplicated by phone) |
| GET | /stock | stock:read | Ingredients with stock and par levels |
| POST | /stock/adjust | stock:write | Add or remove stock with a reason |
| GET | /reports/sales | reports:read | Sales, tax, tips, refunds and breakdowns for a period |
Full request and response schemas are in the developer docs and the OpenAPI file.
Creating an order
curl -X POST https://pos.evrondesk.com/api/v1/orders \
-H "Authorization: Bearer evd_live_..." \
-H "Content-Type: application/json" \
-d '{"external_ref":"web-10045","order_type":"takeaway",
"customer_name":"Sara","customer_phone":"+971500000000",
"items":[{"sku":"201","qty":2},{"sku":"DRK-LIME","qty":1}]}'
Items are matched by SKU, then ID, then name. Prices always come from your EvronDesk menu, never from the request, so a buggy or malicious client can't change what you charge. Unknown items are listed in unmatched_items and noted on the order rather than silently dropped.
Webhooks
Add an endpoint URL in Settings → Integrations → Webhooks, pick events, and copy the signing secret. Events include:
order.created,order.updated,order.paid,order.ready,order.completed,order.voided,order.refundedmenu.item.created,menu.item.updated,customer.created,reservation.createdtest.pingfrom the Send test button
Each delivery is a JSON body with id, type, created_at, restaurant_id, attempt and data. Failed deliveries are retried with backoff for up to eight attempts, and the last deliveries for each endpoint are listed with their response codes so you can debug without guessing.
Good to know
- Errors are always
{"error":{"code","message"}}with standard HTTP status codes. - Time is ISO 8601. Report dates as
YYYY-MM-DDuse the restaurant's own time zone. - Paging uses
next_cursorfrom the previous response. - CORS is enabled, but keep keys on your server, never in a browser or app.
Frequently asked questions
Is the EvronDesk API free?
The API and webhooks are included in the Pro plan, or available on Starter and Growth as the API & webhooks add-on for US$20 a month. There's no per-call fee.
How do I authenticate?
Create a key in Settings → Integrations → API keys, choose its scopes, and send it as Authorization: Bearer <key>. Keys start with evd_live_, are shown once, and can be revoked at any time.
How do I avoid duplicate orders when a request is retried?
Send an external_ref in the body or an Idempotency-Key header. If the same reference arrives again, the API returns the existing order with duplicate: true instead of creating a second one.
How do I verify a webhook?
Each webhook has an X-EvronDesk-Signature header in the form t=<timestamp>,v1=<hmac>. Compute HMAC-SHA256 of <timestamp>.<raw body> with your endpoint secret and compare. Reject anything older than a few minutes.
Is there an OpenAPI spec?
Yes, at https://pos.evrondesk.com/api/v1/openapi.json (OpenAPI 3.1). Import it into Postman, Insomnia or a code generator.