API Reference

Integrations

Connect Possfer with external platforms via HubRise. Sync your menu, customers, and receive incoming orders from delivery platforms like Lieferando, Uber Eats, and Wolt.

HubRise OAuth

Initiate OAuth Flow

Start the HubRise OAuth authorization process. Redirects the user to HubRise to grant access.

GET/api/integrations/hubrise/authorizeAdmin Only

Initiates the HubRise OAuth 2.0 flow and returns the authorization URL.

Response

json

{
  __PH1__: "https://manager.hubrise.com/oauth2/v1/authorize?client_id=...&redirect_uri=...&scope=location[orders.write,catalog.write,customer_list.write]&state=..."
}

Response Fields

Name	Type	Required	Description
`authorize_url`	`string`	Required	Full URL to redirect the user to for HubRise authorization. Open in browser or redirect.

OAuth Callback

Handles the OAuth callback from HubRise after the user grants authorization.

GET/api/integrations/hubrise/callbackPublic

OAuth callback handler. HubRise redirects here after user authorization. Exchanges the authorization code for an access token.

Query Parameters

Name	Type	Required	Description
`code`	`string`	Required	Authorization code provided by HubRise after user consent.
`state`	`string`	Required	CSRF token containing the restaurant ID. Must match the state sent during authorization.

Automatic Handling

This endpoint is called automatically by HubRise during the OAuth flow. You do not need to call it directly. The restaurant is identified via the state parameter.

Connection Management

Connection Status

GET/api/integrations/hubrise/statusAdmin Only

Check whether HubRise is connected and retrieve connection details.

Response

json

{
  __PH0__: true,
  __PH1__: "zrn61-0",
  __PH3__: "2026-03-20T09:15:00Z",
  __PH5__: "2026-02-14T16:30:00Z"
}

Response Fields

Name	Type	Required	Description
`connected`	`boolean`	Required	Whether a valid HubRise connection exists for this location.
`location_id`	`string \| null`	Optional	The HubRise location ID this restaurant is linked to.
`last_sync_at`	`string (ISO 8601) \| null`	Optional	Timestamp of the last successful sync operation.
`connected_at`	`string (ISO 8601) \| null`	Optional	Timestamp when the HubRise integration was connected.

Disconnect

DELETE/api/integrations/hubrise/disconnectAdmin Only

Disconnect the HubRise integration. Revokes the access token and stops syncing.

Response

json

{
  __PH0__: "HubRise integration disconnected successfully."
}

Data Retention

Disconnecting does not delete previously synced data from HubRise. Orders already received will remain in Possfer. You can reconnect at any time.

Sync Operations

Sync Catalog

POST/api/integrations/hubrise/sync/catalogAdmin Only

Push your current menu (categories, items, modifiers, prices) to HubRise. This overwrites the existing HubRise catalog.

Response

json

{
  __PH0__: "Catalog synced successfully.",
  __PH2__: "2026-03-20T14:00:00Z",
  __PH4__: 8,
  __PH5__: 45
}

Sync Customers

POST/api/integrations/hubrise/sync/customersAdmin Only

Push customer records to HubRise. Matches existing customers by email to avoid duplicates.

Response

json

{
  __PH0__: "Customers synced successfully.",
  __PH2__: "2026-03-20T14:05:00Z",
  __PH4__: 234,
  __PH5__: 12,
  __PH6__: 222
}

Webhooks

Webhook Receiver

Receives incoming events from HubRise, such as new orders from delivery platforms. Verified via HMAC signature.

POST/api/webhooks/hubrisePublic

Webhook receiver for incoming HubRise events (e.g., new orders from Lieferando, Uber Eats). Authenticated via HMAC signature, not JWT.

Headers

Name	Type	Required	Description
`X-HubRise-Signature`	`string`	Required	HMAC-SHA256 signature of the request body, used to verify authenticity.
`Content-Type`	`string`	Required	Must be application/json.

Example Payload

json

{
  __PH0__: "order",
  __PH2__: "create",
  __PH4__: "zrn61-0:ord_abc123",
  __PH6__: "zrn61",
  __PH8__: "zrn61-0"
}

HMAC Verification

Always verify the X-HubRise-Signature header against the request body using your HubRise webhook secret. Reject any request with an invalid signature.