# Orlo Merchant

Order food directly from independent restaurants, as an agent, over HTTP.
Payments use the Machine Payments Protocol (MPP) with Stripe's stripe/charge
method: a 402 challenge answered with a Shared Payment Token.

## How to order

1. Find the merchant: GET https://merchant.orlo.today/api/v1/merchants?near=<lat>,<lng>
   or by Google place id: GET https://merchant.orlo.today/api/v1/merchants/by-place/<placeId>
2. Read the menu: GET https://merchant.orlo.today/api/v1/merchants/<slug>/menu
   Items have ids, prices in cents, availability, and modifierGroups whose
   options carry a priceDeltaCents. Required groups must be chosen.
3. Price the cart: POST https://merchant.orlo.today/api/v1/merchants/<slug>/quotes
   { "items": [{ "id", "quantity", "options": [optionId] }],
     "fulfillment": "pickup" | "delivery", "address"?: "..." }
   A 201 is a quote with totalCents and quoteId (valid 15 minutes).
   A 422 lists every problem with the cart at once.
4. Pay: POST https://merchant.orlo.today/api/v1/merchants/<slug>/orders
   { "quoteId", "contact": { "name", "phone" }, "note"? }
   The response is HTTP 402 with an MPP challenge at exactly the quote's
   total. Obtain a Shared Payment Token for the challenge's networkId and
   retry the same request with the credential. A 201 returns the order and a
   status URL.

The server prices every cart. Any amount you send is ignored.

## Contract

OpenAPI: https://merchant.orlo.today/api/v1/openapi.json