ALAYN API

API Reference

The Alayn app runs on a REST API, and the same API is available to your own integrations. You sign in with an Alayn account and act with that account's role and outlets.

Interactive reference (Swagger)openapi.json (OpenAPI 3.0)llms.txt
AUTHENTICATION

Log in, then send a Bearer token

Exchange an Alayn account's email and password for an access token, and send it on every request. When it expires, call /api/v1/auth/refresh with the refresh token.

curl -X POST https://api.alaynai.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"owner@yourcafe.com","password":"••••••••"}'

# → { "success": true, "data": { "accessToken": "…", "refreshToken": "…", "user": { … } } }

curl https://api.alaynai.com/api/v1/orders \
  -H "Authorization: Bearer <accessToken>" \
  -H "x-outlet-id: <outlet-uuid>"
BASE URL & OUTLETS

Every request is scoped to an outlet

Pass the outlet's ID in the x-outlet-id header. If you leave it out, the API uses the first outlet on your account; super-admin accounts must always send it.

Base URL: https://api.alaynai.com/api/v1

Authorization: Bearer <accessToken>

x-outlet-id: <outlet-uuid>

RESPONSES & ERRORS

One envelope for every response

Successful responses wrap the result in data; lists add a meta object with limit, offset and total. Errors return an HTTP status code and a machine-readable code.

{
  "success": true,
  "data": [ … ],
  "meta": { "limit": 20, "offset": 0, "total": 134 }
}
{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "No authentication token provided"
  }
}
ENDPOINTS

What the API covers

All paths sit under /api/v1. Request and response schemas for the documented operations are in the interactive reference and openapi.json.

/authLog in, refresh and log out
/outletsOutlets in your business
/menuMenu, categories and items
/tablesTables and their QR codes
/ordersOrders, status changes and payments
/kitchenKitchen display tickets
/inventoryStock items, adjustments and recipes
/purchase-ordersPurchase orders and deliveries
/waste-logsWaste entries and summaries
/employeesStaff directory and documents
/shiftsShifts, assignments and swaps
/attendanceClock-in and clock-out
/leave-requestsLeave requests and approvals
/analyticsDaily summaries, sellers and reports
/dashboardDashboard metrics
/aiAsk Alayn AI
/ticketsStaff queries and customer feedback
/notificationsIn-app notifications
RATE LIMITING

Rate Limits

Authenticated endpoints are not rate limited today. Public, unauthenticated endpoints are limited per IP address:

  • QR table menu (GET /api/v1/orders/tables/:token/menu): 10 requests per minute
  • Customer feedback (POST /api/v1/tickets/feedback): 5 requests per 15 minutes
  • Password reset (POST /api/v1/auth/forgot-password): 5 requests per 15 minutes
  • HTTP 429: returned when a limit is exceeded, with a Retry-After header
VERSIONING & ACCESS

What's available today

  • The current version is v1, in the URL path.
  • Breaking changes ship as a new version. A deprecated version keeps working for at least 6 months after its deprecation is announced on this page.
  • Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers. The API allows 1,000 requests per minute per IP, with stricter limits on login, QR menus and feedback. A 429 response includes Retry-After.
  • Access uses Alayn user accounts. There are no separate API keys, webhooks or official SDK or CLI yet.
  • Planning an integration with a POS, delivery platform or accounting tool? Write to info@alaynai.com.