Zomato & Swiggy

Zomato and Swiggy don’t offer an open public order API. Restaurant software connects through their POS integration programmes (you apply as a POS partner and get their spec and credentials), or through an integration middleware that already holds that partnership. Either way, the partner sends each new order to F Cartel in the format below and receives status updates from F Cartel.

• Settings → Zomato & Swiggy → Connect. Copy the inbound URL and the signing secret (shown once) into your integration partner’s settings.
• Enter the marketplace outlet ID (optional — when set, orders for any other outlet are refused).
• Enter the status callback URL (and API key, if your partner needs one).
• Map marketplace item ids to menu items. Items whose name exactly matches one menu item need no mapping.
• Press Send test order, then switch the connection on.

POST /api/v1/aggregators/inbound/<connectionId>/orders
Content-Type: application/json
X-FCartel-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">
  (or: Authorization: Bearer <secret>)

{
  "externalOrderId": "ZOM-55120391",
  "outletId": "19283746",
  "customer": { "name": "Aarav", "phone": "+91XXXXXX1234" },
  "fulfillment": "DELIVERY",          // or "PICKUP"
  "paymentMode": "PREPAID",           // or "COD"
  "instructions": "Less spicy",
  "items": [
    { "externalItemId": "88123", "name": "Paneer Tikka", "quantity": 2, "notes": "no onion" }
  ],
  "totals": { "subtotal": 560, "tax": 28, "packaging": 20, "discount": 50, "total": 558 }
}

• 200 — order created (or duplicate: true if that order id was already received; retries are safe).
• 422 ORDER_HELD — held for staff (unmapped items, connection paused, …). Staff fix it and press Retry.
• 400 / 401 / 404 — bad payload, bad signature, unknown connection.

Orders arrive as takeaway orders on the online channel, tagged Zomato or Swiggy, and wait for Accept / Reject unless auto-accept is on. Prices come from your F Cartel menu.

POST <status callback URL>
X-FCartel-Signature: t=…,v1=…
Authorization: Bearer <API key>   (when set)

{ "provider": "ZOMATO", "outletId": "19283746", "externalOrderId": "ZOM-55120391",
  "orderId": "cm…", "status": "READY", "at": "2026-10-27T13:21:40.000Z" }

status is one of ACCEPTED, REJECTED, PREPARING, READY, HANDED_OVER, CANCELLED. The URL must be HTTPS and public.