Getting started

The three steps above make the call for real, against the country and environment you pick in the bar. What follows is the same thing from your terminal, for when you move it into your code.

Request an access token

The credential is an API key with its secret, created in the Developers section of BistroWeb. $BISTRO_HOST is the host for your country and environment; the repeated /oauth is not a typo: the first one picks the service at the gateway, the second is the service's own route.

curl -X POST "https://$BISTRO_HOST/oauth/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data grant_type=client_credentials \
  --data client_id=your-api-key \
  --data client_secret=your-secret \
  --data scope=transactions.read

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "transactions.read"
}

The token lasts an hour. Reuse it until it expires instead of requesting one per call: the endpoint is rate limited.

Query the sales

The token travels in the Authorization header, with the Bearer prefix and a space.

curl -G "https://$BISTRO_HOST_OAUTH/transactions/sales" \
  -H "Authorization: Bearer $BISTRO_TOKEN" \
  --data-urlencode "ShopCode=1001" \
  --data-urlencode "From=2026-07-01T00:00:00Z" \
  --data-urlencode "To=2026-08-01T00:00:00Z" \
  --data-urlencode "Limit=50"

Two details that matter more than they look:

• From is inclusive and To is exclusive. To request all of July, To is August 1st at 00:00, not July 31st.
• ShopCode can be repeated to request several shops in one call.

To walk every page: while has_more is true, repeat the call passing the next_page you got in the Page parameter.

When something fails

• 401 on the token: the API key or secret is wrong, or the key was revoked.
• 400 with invalid_scope: you asked for a scope the credential does not have.
• 403 on a query: the token is missing the scope the endpoint requires —transactions.read for these routes— or the shop is not among the ones enabled for the credential.

If you are still on Transactions API v1

It is discontinued, but it still works. It authenticates with BistroWeb username and password, and the token lasts two days with no refresh endpoint:

curl -X POST "https://$BISTRO_HOST/bistroapi/api/v1.0/Token" \
  -H "Content-Type: application/json" \
  -d '{
        "username": "your-user@company.com",
        "password": "your-password"
      }'

curl -G "https://$BISTRO_HOST/bistroapi/api/v1.0/sales" \
  -H "Authorization: Bearer $BISTRO_TOKEN" \
  --data-urlencode "ShopCode=1001" \
  --data-urlencode "From=2026-07-01T00:00:00Z" \
  --data-urlencode "To=2026-08-01T00:00:00Z"

The failures there are different ones: 401 is a wrong username or password, 403 on the token means the user is missing the ApiUser role, and 403 on a query means a shop that is not enabled for that user.