Get the menu
Returns everything a menu page and checkout need in one call: the restaurant (branding, capabilities, opening hours, special opening hours, delivery zones and shared add-on groups), the active menus, categories with products, variants, add-ons and allergens, code-based coupons, automatic promotions, the allergen list and upsell products.
Only what can be ordered now. menus and categories contain only the menus that are active when the response is built: the validity period (startsOn/endsOn) is checked first, then the schedules, and the default menu is the fallback. upsell.products is filtered the same way. Products and add-ons the restaurant has hidden or marked unavailable are left out.
Two sets of opening hours. restaurant.openingHours are the kitchen’s hours and the only set that decides whether an order is accepted. Always gate the ordering flow on these. restaurant.venueHours are the venue’s hours (when the doors are open) and are for display only. An empty venueHours means the venue follows the kitchen; show openingHours instead.
Caching. The response is cached at the edge (30 s, plus 300 s stale-while-revalidate) and carries a weak ETag. Send it back in If-None-Match to get 304 Not Modified. Because of the cache, show the preparation time from GET /prep-time, not from restaurant.prepTime.
Address. restaurant.address is the visiting address, or null: the same object as in GET /restaurant. Use it on the contact page and for address and geo in Restaurant JSON-LD.
Allergens. products[].allergens are codes. Look them up in the top-level allergens list, which always comes in the same order.
Authentication
Either this or a trusted browser origin. The restaurant’s API key, sent as Authorization: Bearer lbs_…. Use it from your server only, never in browser code. Keys are issued per restaurant by LettBestilt.
Either this or an API key. No key is needed when the request’s Origin header is trusted for this restaurant: https://{slug}.lettbestilt.no, a verified domain of the restaurant, or a partner origin LettBestilt has bound to the restaurant. Browsers set Origin themselves; it is not something you configure. Not accepted by GET /site-gate, which requires an API key.
Headers
The ETag from an earlier response. If the menu has not changed, the response is 304 Not Modified with no body.
Query parameters
The restaurant’s slug, which is also its LettBestilt subdomain ({slug}.lettbestilt.no).
Response
The menu, with a weak ETag and Cache-Control headers.
Top-level categories on the active menus, with their products.
Code-based coupons, without the code itself. The customer types the code; POST /coupons/validate checks it.
Automatic promotions. Show them as banners; the server applies the best match when the order is created.
Products the restaurant wants to suggest in the cart, or null if upsell is not set up. mode tells whether the list is picked by popularity or by hand.