Aexir owner data API

Read-only access to your own restaurant data: orders, daily totals, locations and menu. Version 1.

Getting started

Base URL: https://aexir.com/api (also https://europe-west2-aexir-website.cloudfunctions.net/api). Every endpoint lives under /v1.

Create an API key yourself from the POS settings (Settings, Data & API, API access; admins with access to all locations), or ask Aexir support to create one for you. A key looks like axk_ followed by 48 characters. It is shown once; keep it somewhere safe. Then:

curl -H "Authorization: Bearer axk_YOUR_KEY" \
  "https://aexir.com/api/v1/orders?from=2026-10-01&to=2026-10-07"

Add &format=csv to /v1/orders or /v1/summary/daily to get a spreadsheet-ready file instead of JSON. A CSV call returns the whole date range in one file, with no paging.

Authentication

Send the key in the Authorization header on every request:

Authorization: Bearer axk_YOUR_KEY

• A key belongs to one restaurant and can only ever read that restaurant.
• Keys created with customer data off never return names, phone numbers, email addresses, delivery addresses or order notes. Use one of those for dashboards and shared spreadsheets.
• Keys can be revoked at any time. A revoked key stops working within five minutes.
• Do not put the key in a URL. Browsers, proxies and servers keep URLs in their history and logs, so the key only travels in the header.

Endpoints

Parameters for /v1/orders

/v1/summary/daily takes from, to, tz and format. It reads every order in the range, so keep ranges to a few months at most.

The order object

{
  "id": "Qm3kZ9...",
  "placedAt": "2026-10-08T11:50:37+01:00",
  "status": "Completed",
  "effectiveStatus": "Completed",
  "orderType": "Delivery",
  "channel": "ios-7.1.1",
  "location": "Main",
  "customer": {
    "name": "Sam Example",
    "phone": "07700 900000",
    "email": "sam@example.com",
    "address": "1 High Street, M1 1AA"
  },
  "note": "Ring the bell",
  "redacted": false,
  "lines": [
    {
      "name": "Chicken Burger",
      "size": "Large",
      "unitPrice": 8.5,
      "qty": 2,
      "extras": [
        {
          "name": "Cheese",
          "price": 0.5
        }
      ],
      "mealDeal": {
        "drink": "Coke",
        "side": "Fries",
        "price": 2
      },
      "notes": "no mayo",
      "lineTotal": 22
    }
  ],
  "rawItems": {
    "items": [
      "Chicken Burger: (8.5), Extras: Cheese(0.5),"
    ],
    "size": [
      "Large"
    ],
    "mealDeal": [
      "[\"Coke\"] [\"Fries\"]"
    ],
    "mdPrice": [
      2
    ],
    "itemNotes": [
      "no mayo"
    ]
  },
  "totals": {
    "subtotal": 22,
    "discount": 0,
    "discountRaw": 0,
    "discountType": "amount",
    "deliveryFee": 2.5,
    "serviceCharge": 0,
    "tip": 0,
    "vat": 3.67,
    "total": 24.5,
    "refund": 0
  },
  "payment": {
    "method": "Card",
    "reference": "pi_3Q..."
  }
}

CSV output

format=csv returns UTF-8 with a byte order mark, so Excel opens accented names correctly. /v1/orders gives one row per order line (an order with three different items is three rows; the order-level columns repeat). /v1/summary/daily gives one row per day with the breakdowns flattened as Card=120.50; Cash=40.00.

curl -H "Authorization: Bearer axk_YOUR_KEY" \
  "https://aexir.com/api/v1/orders?from=2026-10-01&to=2026-10-31&format=csv" -o october.csv

A CSV call returns every order in the requested range in one file: there is no paging and limit and cursor are ignored. The X-Order-Count response header says how many orders the file holds. If the range holds more than 20,000 orders the call fails with 400 too_many_orders instead of returning a shortened file; ask for fewer days at a time (one month per call is plenty for most restaurants).

Excel (Power Query)

Data tab, Get Data, From Other Sources, Blank Query, then open the Advanced Editor and paste:

let
    Key = "axk_YOUR_KEY",
    Url = "https://aexir.com/api/v1/orders?from=2026-10-01&to=2026-10-31&format=csv",
    Raw = Web.Contents(Url, [Headers = [Authorization = "Bearer " & Key]]),
    Table = Csv.Document(Raw, [Delimiter = ",", Encoding = 65001, QuoteStyle = QuoteStyle.Csv]),
    Promoted = Table.PromoteHeaders(Table, [PromoteAllScalars = true])
in
    Promoted

The query pulls every order in the date range in one go (no paging needed). When Excel asks about privacy levels choose Anonymous for the connection (the key is already in the header). Refresh the query to pull fresh data. For the daily summary swap the URL for /v1/summary/daily?from=...&to=...&format=csv.

Google Sheets

Sheets' built-in IMPORTDATA cannot send an Authorization header, and this API never accepts a key in the URL (it would end up in logs and in the sheet's formula history). Use a short Apps Script function instead: Extensions, Apps Script, paste this, save, then use =AEXIR("orders", "2026-10-01", "2026-10-31") in a cell. Each call returns the whole date range (no paging).

const AEXIR_KEY = 'axk_YOUR_KEY';
const AEXIR_BASE = 'https://aexir.com/api/v1/';

/**
 * Pull Aexir data into the sheet.
 * @param {string} what  "orders", "summary", "locations" or "menu"
 * @param {string} from  start day YYYY-MM-DD (orders and summary)
 * @param {string} to    end day YYYY-MM-DD
 * @customfunction
 */
function AEXIR(what, from, to) {
  const path = what === 'summary' ? 'summary/daily' : what;
  let url = AEXIR_BASE + path + '?format=csv';
  if (from) url += '&from=' + from;
  if (to) url += '&to=' + to;
  const res = UrlFetchApp.fetch(url, { headers: { Authorization: 'Bearer ' + AEXIR_KEY }, muteHttpExceptions: true });
  if (res.getResponseCode() !== 200) throw new Error(res.getContentText());
  return Utilities.parseCsv(res.getContentText().replace(/^\uFEFF/, ''));
}

Sheets gives a custom function only a short time to run, so if a very busy month is slow to load, ask for a week at a time or use the daily summary. locations and menu are JSON only; for those return JSON.parse(...) and map the fields you need, or ask Aexir support for a template sheet. Scripts in a shared sheet can be read by anyone who can edit it, so use a key with customer data off for shared sheets.

Managing keys

Keys are created and revoked in the POS settings by admins with access to all locations, or by Aexir support on request. The POS also asks for the owner PIN before it opens the screen, but the server only accepts key changes from an admin account with access to all locations. The same operations are available over HTTP for those apps with a signed-in Firebase ID token rather than an API key:

A POS token must belong to an admin user of that restaurant. Any admin can list keys; only an admin with access to all locations can create or revoke one (a branch-only admin gets 403 owner_only). Keys cannot be created for a restaurant that is switched off on Aexir (403 tenant_disabled), and its existing keys stop working with the same error. A few accounts share their data with another brand; keys for them are set up through Aexir support (403 shared_project). An Aexir staff token adds ?tenant=slug. lastUsedAt is updated at most once an hour.

Errors and limits

Every error is JSON in the shape {"error": {"code": "...", "message": "..."}}.

• 120 requests per minute per key.
• JSON: up to 500 orders per page. CSV: the whole range, up to 20,000 orders. 366 days per request.
• Responses are never cached (Cache-Control: private, no-store).
• Browser calls work from any origin for GET requests (CORS), so the key can be used from a browser-based tool. Keep it off public pages.

Data notes

• Days are local. from and to are whole days in tz; the POS dashboard uses the device's own local day, so a day boundary can differ by an hour when a device is in another zone.
• Daily summary maths. gross adds each order's total and refund back together (the value before the refund); refunds is the sum of refund amounts; net = gross - refunds, which equals the sum of what was actually kept. Orders in awaiting_payment are ignored. Declined orders with no refund are counted in declined and excluded from money totals. byPayment, byOrderType and byLocation split net.
• Discounts. The till stores a percentage and the customer apps store an amount. The API always reports discount as money; on till orders it is the percentage of the line totals (the delivery fee is never discounted), rounded to the penny, so it stays right on refunded and fully comped orders.
• Item names. Menu names containing a comma or a colon cannot be separated from their extras by the stored format; the API reads them exactly as the POS does and rawItems is there for checking.
• Locations. orders.location is the branch name, matching name in /v1/locations. Older or till orders can carry an empty location.
• Menu inStock. The POS has no single in-stock flag: an item is available where its branch list includes the branch, and a stock count of 0 at a branch means out of stock there. inStock is true when the item is listed at at least one branch and is not at 0 everywhere it is listed; stockCount is included when the restaurant keeps counts.
• Payment method on till orders. The till records the method (Cash or Card) separately from whether the order was paid; the API returns the method in payment.method and the paid state in payment.status.
• Accounts that share data with another brand. A few accounts keep two brands in one shared data store, so a key could not be limited to one brand's orders and customers. These accounts get API access through Aexir support rather than the POS (key creation returns 403 shared_project).
• Nothing is invented. Fields the apps do not write (service charge, email on till orders, Stripe reference on cash orders) come back as 0 or an empty string.

Questions: support@aexir.com