---
title: "List a venue's orders"
method: GET
path: "/api/v1/venues/{id}/orders"
tags: ["Public API v1"]
---

# List a venue's orders

`GET /api/v1/venues/{id}/orders`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/api/v1/venues/{id}/orders`
- Auth: HTTP bearer

Orders only, newest first. A service request ("more napkins") has no money on it and does not
appear here.

READ-ONLY, and it will stay that way. An order is created by the guest flow on the request
origin, priced from the venue's own catalogue at submit time, and moved through its states by
the staff standing in the room. There is no POST, PATCH or DELETE on this surface, because an
API-created order has no scan, no signed cart and no table behind it, and an API-cancelled one
would silently contradict a ticket already printed in the kitchen.

KEYSET PAGINATION, not offsets. `cursor` is the `reference` of the last order you saw; a
cursor that names no order in this venue is a `400` `invalid_cursor` rather than page one,
because answering page one would make a broken walk look like a complete one. Walk until
`nextCursor` is `null`.

MONEY IS INTEGER MINOR UNITS in the currency beside it — 1250 is €12.50. There are no floats
anywhere on this surface. Every amount was COPIED onto the order at submit time, so a later
menu edit cannot restate an order this endpoint has already reported. `totalMinor` is `null`
for a market-priced order, which is why `analytics` reports `unpricedOrders` separately.

`note` is the guest's own free text for the kitchen ("no peanuts"). It is included because it
is already venue-visible content — the console's request view returns it and staff read it off
the printed ticket — so withholding it here would leave an integration printing an incomplete
ticket.

`paidAt` is the moment staff confirmed payment. It is a timestamp and never an amount held:
Scanduro holds no funds.

## Query parameters

- `from` string
- `to` string
- `status` 'received' | 'accepted' | 'preparing' | 'ready' | 'served' | 'cancelled'
- `limit` integer
- `cursor` string

## Response `200`

One page of orders, newest first.

- object
  - `data` object[], required
    - `reference` string, required: The order's public id — the only identity that leaves the tenant.
    - `ticketNumber` integer, nullable: The kitchen's own small number, counted per venue-day.
    - `ticketDay` string, nullable: The venue-local day (YYYY-MM-DD) the ticket number counts within.
    - `tableName` string, nullable: The label of the place the code was scanned at.
    - `status` 'received' | 'accepted' | 'preparing' | 'ready' | 'served' | 'cancelled', required
    - `totalMinor` integer, nullable, required: Integer minor units. Null for a market-priced order.
    - `currency` string, required
    - `paymentMethod` string, nullable: How the guest chose to pay, as recorded on the order.
    - `paymentStatus` string, nullable
    - `paidAt` string, nullable
    - `note` string, nullable
    - `source` string
    - `createdAt` string
    - `updatedAt` string
    - `lines` object[], required
      - `name` string, required: The product name AS SOLD, copied at order time.
      - `quantity` integer, required
      - `unitPriceMinor` integer, nullable
      - `lineTotalMinor` integer, nullable, required: Quantity times unit price plus the chosen options.
      - `currency` string, nullable
      - `options` object[]
        - `label` string, required
        - `deltaMinor` integer, required: Added minor units, as copied at order time.
  - `nextCursor` string, nullable, required

## Other responses

- `400`: Validation failure, a missing Idempotency-Key, or an unusable cursor.
- `401`: No key, a malformed key, an unknown key, a revoked key or an expired key. Deliberately one response for all five: telling the caller which applies would make the endpoint an oracle for enumerating valid keys.
- `403`: Either the plan does not include API access (`plan_required`) or the key does not carry the required scope (`missing_scope`). The credential itself is valid in both cases.
- `404`: No such code in this workspace. Another tenant's id reads as absent, not as forbidden.
- `429`: Per-key limit reached. Retry-After gives the seconds remaining in the window.

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)