Marketplace Engine API

Licensed Acrontec marketplaces expose a single REST API version — /api/v3 — used by the Next.js storefront, Flutter customer / partner / delivery-driver apps, vendor tooling, the franchisee panel, and admin integrations. The Nectar Eats demo is the reference implementation of this contract.

API overview

The API covers:

Storefront config, zones, restaurants, products, and campaigns
Customer auth, guest sessions, cart, checkout, and order tracking
Wallet, loyalty, coupons, cashback, and gift cards
Delivery-driver workflow (orders, location, earnings)
Vendor / restaurant operations and advertisements
Support tickets, knowledge centre, and admin JSON surfaces
Supplies shop and in-restaurant EPOS helpers

Base URL

Every install mounts the same versioned prefix on the marketplace API host:

{marketplace-host}/api/v3/

Example paths: /api/v3/config, /api/v3/auth/login, /api/v3/customer/order/place. There is no separate public v1 / v2 API for new clients.

Authentication

Protected customer routes use Laravel Passport Bearer tokens issued by auth endpoints (not static “API keys” from a developer settings screen). Guest cart/order flows use a guest session from POST /auth/guest/request.

GET /api/v3/customer/info
Authorization: Bearer {access_token}
Content-Type: application/json
zoneId: [3]
X-localization: en

Full details: Authentication.

Common headers

Authorization: Bearer
zoneId
X-localization
Content-Type: application/json

zoneId — JSON array string of active delivery zone IDs (e.g. [3])
X-localization — content/UI locale (e.g. en, tr)
Admin support routes also accept X-Web-Admin-Support-Key where configured

Core endpoint groups

Representative paths (all under /api/v3). See the endpoint catalog for a fuller map.

Config & zones

GET /config
GET /zone/list
GET /config/get-zone-id
GET /landing-page

Restaurants & products

GET /restaurants/…
GET /restaurants/promoted
GET /products/details/{id}
GET /categories/products/{id}

Auth

POST /auth/sign-up
POST /auth/login
POST /auth/guest/request
POST /vendor/auth/login

Cart & orders

GET /customer/cart/list
POST /customer/cart/add
POST /customer/order/place
GET /customer/order/track

Delivery driver

POST /auth/driver/login
GET /driver/current-orders
PUT /driver/update-order-status
POST /driver/record-location-data

Vendor

GET /vendor/current-orders
PUT /vendor/update-order-status
GET /vendor/get-products-list
… /vendor/advertisement/*

Wallet & offers

GET /customer/wallet/transactions
GET /coupon/list
GET /cashback/list
POST /gift-cards/validate

Support & shop

GET|POST /support-tickets/*
GET /knowledge-centre/*
GET /shop/products
POST /epos/login

Realtime & callbacks

Client apps rely on Firebase Cloud Messaging for push updates. Payment providers (where enabled) call marketplace webhook URLs for settlement events. There is no public outbound “order.created” event bus documented for third parties — ask Acrontec if you need a custom integration. Details: Webhooks & realtime.

Errors & rate limits

Validation and auth failures return JSON error payloads (often an errors array of { code, message } objects). Public traffic is budgeted at roughly 600 requests/minute per user or IP. See Error codes and Rate limits.

Next steps

Authentication Endpoint catalog Clients & tools Contact