REST API

The SDKs are thin wrappers over these. Everything on the embed surface is a GET, is cacheable, and authenticates with Authorization: Bearer pk_….

a request

curl "https://api.armenus.app/v1/embed/items/$ITEM_ID" \
  -H "Authorization: Bearer pk_live_..."

Embed endpoints

Endpoint	Returns
`/v1/embed/config`	Key scope and readable merchants.
`/v1/embed/items/:itemId`	One dish.
`/v1/embed/items?ids=a,b,c`	Up to 50 dishes, in the order asked.
`/v1/embed/merchants/:id/items`	A merchant's dishes. ?withModel&limit&offset
`/v1/embed/merchants/:id/items/by-ref/:ref`	One dish, by your own identifier.

The shapes they return are documented under Objects.

Key management

These take a secret key or a dashboard session — never a pk_. A publishable key that could mint publishable keys would be a privilege escalation available to anyone who decompiled an app.

Method	Endpoint	Auth
`GET`	`/v1/partner/publishable-keys`	`ak_`
`POST`	`/v1/partner/publishable-keys`	`ak_`
`DELETE`	`/v1/partner/publishable-keys/:keyId`	`ak_`
`GET`	`/v1/restaurant/publishable-keys`	`owner session`
`POST`	`/v1/restaurant/publishable-keys`	`owner session`
`DELETE`	`/v1/restaurant/publishable-keys/:keyId`	`owner session`

Caching

Dish responses carry public, max-age=30, s-maxage=300, stale-while-revalidate=86400. /v1/embed/config is private, because its merchant list is scoped to the calling key and a shared cache keyed on URL alone would serve one partner’s list to another.

Versioning & support

The API is versioned in the path. Additive response fields are not a breaking change, so parse defensively. SDKs follow semantic versioning.

Package	Version	Requires
`@armenus/sdk-core`	0.1.0	Any runtime with `fetch`
`@armenus/sdk-react`	0.1.0	React 18+
`@armenus/sdk-react-native`	0.1.0	React Native 0.76+, iOS 13+, Android 24+
`armenus` (Dart)	0.1.0	Flutter 3.22+, iOS 13+, Android 24+

Questions, or a rate limit that does not fit your traffic: ask the administrator who provided your integration key.