Skip to content
Table BuddyTable BuddyRestaurant platform
Sign inGet started
API referenceVersioning

Versioning

The version is in the path, /api/v1. It changes only for something that cannot be done compatibly, and a new version would run beside this one for at least twelve months, not replace it. This contract holds from the release of September 30, 2026; that release’s own changes are in the changelog.

What may change within v1

  • New endpoints. One filed under a scope keys already carry is announced first in the changelog, naming the scope.
  • New optional request fields, new query parameters, new headers.
  • New fields in an answer. Ignore the ones you do not know; never use a decoder that fails on an unknown key.
  • New values in an answer's enum (a status, a channel). Give every switch a default branch.
  • New error codes, for failures that are new. Branch on the codes you handle and treat the rest by status.
  • New scopes.
  • The wording of error.message, the docs and the examples. The message is for people: branch on error.code.

What will not

  • Remove or rename an endpoint, a field, a scope or an error code.
  • Change a field's type or its unit.
  • Narrow a range a request may send, or make an optional field required.
  • Change the status or the code of a failure that already exists.
  • Reuse an id that was retired.

Not in the API

Left out on purpose, and why. Each is a console act today.

Marketing campaigns, test sends, audiences, consent and the never-email list
Mail to guests goes out under the restaurant's name, and CAN-SPAM makes the restaurant liable for every message. It needs the platform switch, a verified domain and Email guests, which no default role holds.
Deleting a restaurant, a sample, a guest, a supplier, an employee or a menu item
Deleting a record that holds history belongs to a person at a screen that says what goes with it. Nothing in the API deletes history.
Members, invitations, staff roles, access and API keys
They are security-sensitive, and grants are ranked. A key never makes a key.
Settings: taxes, payment methods, the business day, table ordering, sending domains
Each changes every future bill or figure.
Integrations: connecting, pausing, resuming, running, disconnecting, credentials, the Toast deposit helper
They change a live connection and handle credentials. A credential never travels through an API body.
Pay rates, salaries, pay rules, timesheet approval and the payroll file
They are Pay rates and payroll's alone, and approval fixes a pay period. Reads of pay need the payroll:read scope; writes stay in the console.
Formal notices (warnings and write-ups)
A notice is a personnel record, under the rank rule.
Ledger entries, transfers, categories, account edits, and undoing a settlement or a payout
The drawer rule, backdating and accounts another system keeps make each a console act for now.
Opening, counting and closing a cash drawer; cash in and out
They are physical acts at the register.
Uploading, editing, rejecting or splitting a supplier invoice; supplier credits
Upload has its own door and review is a screen.
Creating and editing menu items, recipes and preps, add-on groups and categories
Their engines take form-shaped input, and Toast owns the names and prices of linked items.
Creating and editing tables and reservations
Little value to another program; a table's status is in the API.
The accounting export and QuickBooks
The export is a download that marks days posted, and the QuickBooks sync is its own.
Anything an integration writes (imported checks, refunds, write-offs, outside money and staff)
Only an integration's own sync writes through them, under its status.
Changing a record another system keeps: a Toast check, a kept account or payment method, a linked item's name, price or place on the menu, a Toast punch or week
The record is the other system's truth. The endpoints that touch such records refuse in that system's own words.
Pay, labor cost and labor % to a key without payroll:read
They are Pay rates and payroll's alone, totals included: the fields are left out, never zeroed.
Webhooks or an event feed
Later.

Tracking the surface

The OpenAPI document is generated from the same catalog as these pages and the route’s validation, so nothing reaches the API without appearing in it. Diffing it between two dates is the surest way to see what moved.

Diff the surface
curl -s "$TABLEBUDDY_URL/api/v1/openapi.json" > openapi.$(date +%F).json
diff <(jq -S . openapi.2026-10-01.json) <(jq -S . openapi.$(date +%F).json)