{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "thefork", "name": "TheFork B2B API", "vendor": "TheFork (La Fourchette SAS)", "vendorUrl": "https://www.thefork.com", "kind": "http-api", "category": "local-bookings", "summary": "TheFork's B2B API lets restaurants and their software partners, such as CRM vendors and AI phone agents, read availability and create, change and cancel reservations in TheFork Manager, with webhooks, reviews and customer data.", "url": "https://www.anchorterminal.com/tools/thefork", "markdownUrl": "https://www.anchorterminal.com/tools/thefork.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/thefork.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/thefork.json", "license": "Proprietary service under TheFork Partners API Terms of Use (La Fourchette SAS) and any core agreement with TheFork", "transports": [ "http" ], "remoteUrl": "https://api.thefork.io/manager", "packages": [], "auth": "oauth", "authNotes": "Partner approval required. Credentials are requested from the integrations team at integrations@thefork.com with a company name and use case. TheFork sends a client_id and client_secret through a secure channel, and the client exchanges them at https://auth.thefork.io/oauth/token (OAuth 2.0 client credentials, audience https://api.thefork.io) for a Bearer token that lasts 8,600 seconds. Nine scopes limit each client, from full access (tfm-restaurant) to read-only availability. restaurantUuid and groupUuid values for each restaurant come from TheFork, as no endpoint lists them.", "pricing": "byo-plan", "pricingNotes": "No API prices are published. Access follows a partnership with TheFork, and the rate limit is set by contract. The API terms mention test data for pre-launch testing. No sandbox host or self-serve tier is documented (https://docs.thefork.io/getting-started).", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer portal, llms.txt or OpenAPI schema (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.thefork.io/B2B-API/introduction", "llmsTxt": "https://docs.thefork.io/B2B-API/llms.txt", "openapi": "https://api.thefork.io/manager/openapi.json", "capabilities": [ "booking.reservations", "booking.availability", "booking.venue", "crm.records", "events.webhooks-send" ], "tags": [ "hosted", "closed-source", "partner-only", "rest", "oauth", "openapi", "llms-txt", "webhooks", "eu", "restaurants" ], "graded": true, "anchor": { "graded": true, "score": 43.6, "grade": "E", "agentReady": false, "rank": 951, "ranked": true, "rankOf": 1076, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 56, "maintenance": 15, "payments": 5, "reliability": 35, "schema": 87, "security": 42, "transparency": 47 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 35, "points": 7, "reason": "Graded as a hosted API. status.thefork.io redirects to a private Rootly page behind a sign-in, so there is no public status page (0) and no readable history (5). The docs leave the rate limit to each contract. The Partners API terms set 200 calls a minute and 10,000 a day by default, which we take as published numbers for part of the line (8 of 15). 429 and 503 call for exponential backoff, and the llms.txt says to check the current state before retrying a POST or PATCH, but no idempotency key exists (12 of 15). No SLA, and the terms disclaim uptime (0). v1 is generally available (10). Total 35." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 87, "points": 14.14, "reason": "OpenAPI 3.1.0 schema at api.thefork.io/manager/openapi.json, generated from the deployed code, with 19 operations and the scopes (25). A B2B llms.txt written for agents (10). Every operation has a description, and the llms.txt says when to use each and which pages to ignore, though per-endpoint when-not-to-use guidance is thin (16 of 20). 319 enums and required fields across the schema, with the E.164 phone pattern stated (14 of 15). 272 examples, error responses on every operation and three error formats explained (14 of 15). One version in the path with a written policy of 6 months' support after a breaking change, but no changelog (8 of 15). Total 87." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 56, "points": 9.1, "reason": "List endpoints return UUIDs only and need one detail call per item, which keeps lists small but multiplies calls. No field selection (12 of 25). page and limit with totalCount or hasNext, and date filters on every list (16). Business codes in data.code (NO_AVAILABILITY, DOUBLE_BOOKING, PAYMENT_GUARANTEE_NOT_SUPPORTED), but gateway errors carry only a message and three formats must be parsed (15). No idempotency key. 409 DOUBLE_BOOKING and DOUBLE_CANCELLATION catch repeats, and the docs say to check state before retrying writes (8 of 20). No SDKs, five required customer fields, and restaurant UUIDs must come from TheFork because no endpoint lists them (5). Total 56." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 42, "points": 7.35, "reason": "OAuth 2.0 client credentials with nine scopes in the schema, from full access down to read-only availability. The secret is delivered through a secure channel. No rotation procedure was found (25 of 30). Read-only scopes exist, and tfm-restaurant:unrestricted-reservations, which books outside published slots, is not granted by default (14 of 20). Responses carry review text and customer data written by people, and the best-practices page covers input sanitisation but not untrusted output (3). No audit log or per-call view found (0). www.thefork.com/.well-known/security.txt returns 404, the main site answered with a bot check, and no SOC 2, ISO 27001 or disclosure programme was found in the developer portal (0). Total 42." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 5, "points": 0.63, "reason": "No x402, MPP or L402 (0). No API prices published (0). The API terms mention test data before launch, but no sandbox host or free tier is documented, and both follow approval (5 of 20). A person emails the integrations team and TheFork sends credentials (0). Total 5." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 15, "points": 1.31, "reason": "No changelog or dated release notes. The developer portal files, including the llms.txt, carry a Last-Modified date of 5 October 2026, which shows a recent docs deployment but not what changed, so it earns part of the line (10 of 30). No three dated changes in 90 days (0). An integrations email address, no public issue tracker or community channel (5 of 15). No official SDKs (0). No package to assess (0). Total 15." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 47, "points": 4.11, "note": "editorial 33, provenance 60", "reason": "Closed service. The Partners API terms are a public PDF naming La Fourchette SAS, though they describe an affiliate Partners API and defer to any core agreement (15 of 30). The terms cover data ownership and credential use. The privacy policy on www.thefork.com was behind a bot check, so retention and processing statements were unread (3 of 30). A written versioning policy with 6 months' support for the previous version, without dated notices (15 of 20). No subprocessor list or data locations found (0). Total 33." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "List endpoints return UUIDs only and need one detail call per item, which keeps lists small but multiplies calls. No field selection (12 of 25). page and limit with totalCount or hasNext, and date filters on every list (16). Business codes in data.code (NO_AVAILABILITY, DOUBLE_BOOKING, PAYMENT_GUARANTEE_NOT_SUPPORTED), but gateway errors carry only a message and three formats must be parsed (15). No idempotency key. 409 DOUBLE_BOOKING and DOUBLE_CANCELLATION catch repeats, and the docs say to check state before retrying writes (8 of 20). No SDKs, five required customer fields, and restaurant UUIDs must come from TheFork because no endpoint lists them (5). Total 56.", "maintenance": "No changelog or dated release notes. The developer portal files, including the llms.txt, carry a Last-Modified date of 5 October 2026, which shows a recent docs deployment but not what changed, so it earns part of the line (10 of 30). No three dated changes in 90 days (0). An integrations email address, no public issue tracker or community channel (5 of 15). No official SDKs (0). No package to assess (0). Total 15.", "payments": "No x402, MPP or L402 (0). No API prices published (0). The API terms mention test data before launch, but no sandbox host or free tier is documented, and both follow approval (5 of 20). A person emails the integrations team and TheFork sends credentials (0). Total 5.", "reliability": "Graded as a hosted API. status.thefork.io redirects to a private Rootly page behind a sign-in, so there is no public status page (0) and no readable history (5). The docs leave the rate limit to each contract. The Partners API terms set 200 calls a minute and 10,000 a day by default, which we take as published numbers for part of the line (8 of 15). 429 and 503 call for exponential backoff, and the llms.txt says to check the current state before retrying a POST or PATCH, but no idempotency key exists (12 of 15). No SLA, and the terms disclaim uptime (0). v1 is generally available (10). Total 35.", "schema": "OpenAPI 3.1.0 schema at api.thefork.io/manager/openapi.json, generated from the deployed code, with 19 operations and the scopes (25). A B2B llms.txt written for agents (10). Every operation has a description, and the llms.txt says when to use each and which pages to ignore, though per-endpoint when-not-to-use guidance is thin (16 of 20). 319 enums and required fields across the schema, with the E.164 phone pattern stated (14 of 15). 272 examples, error responses on every operation and three error formats explained (14 of 15). One version in the path with a written policy of 6 months' support after a breaking change, but no changelog (8 of 15). Total 87.", "security": "OAuth 2.0 client credentials with nine scopes in the schema, from full access down to read-only availability. The secret is delivered through a secure channel. No rotation procedure was found (25 of 30). Read-only scopes exist, and tfm-restaurant:unrestricted-reservations, which books outside published slots, is not granted by default (14 of 20). Responses carry review text and customer data written by people, and the best-practices page covers input sanitisation but not untrusted output (3). No audit log or per-call view found (0). www.thefork.com/.well-known/security.txt returns 404, the main site answered with a bot check, and no SOC 2, ISO 27001 or disclosure programme was found in the developer portal (0). Total 42.", "transparency": "Closed service. The Partners API terms are a public PDF naming La Fourchette SAS, though they describe an affiliate Partners API and defer to any core agreement (15 of 30). The terms cover data ownership and credential use. The privacy policy on www.thefork.com was behind a bot check, so retention and processing statements were unread (3 of 30). A written versioning policy with 6 months' support for the previous version, without dated notices (15 of 20). No subprocessor list or data locations found (0). Total 33." }, "sources": [ { "what": "B2B API llms.txt", "url": "https://docs.thefork.io/B2B-API/llms.txt", "seen": "2026-10-14" }, { "what": "OpenAPI schema", "url": "https://api.thefork.io/manager/openapi.json", "seen": "2026-10-14" }, { "what": "getting started, versioning and rate limiting", "url": "https://docs.thefork.io/getting-started", "seen": "2026-10-14" }, { "what": "preliminary steps and credentials", "url": "https://docs.thefork.io/preliminary-steps", "seen": "2026-10-14" }, { "what": "B2B introduction", "url": "https://docs.thefork.io/B2B-API/introduction", "seen": "2026-10-14" }, { "what": "best practices", "url": "https://docs.thefork.io/best-practices", "seen": "2026-10-14" }, { "what": "Partners API terms of use (PDF)", "url": "https://docs.thefork.io/pdf/LaFourchette-Partners-API-Licence-2.pdf", "seen": "2026-10-14" }, { "what": "status page redirect (private Rootly page)", "url": "https://status.thefork.io/", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: www.thefork.com answered every request with a bot check (403), so its privacy policy, terms of use and any security or disclosure page were not read", "unchecked: TheFork's status history, which sits on a private Rootly status page", "Whether a sandbox exists for the B2B API. The terms mention test data, but no sandbox host is documented", "Whether the Partners API terms PDF, written for affiliate partners, is the licence for the B2B API. The portal footer links it as the terms of use", "Whether client secrets can be rotated on request" ] }, "negative": 0, "verdict": "A venue-side API with a generated OpenAPI 3.1 schema, an llms.txt written for agents and nine OAuth scopes down to read-only availability. It acts for restaurants and their vendors, not diners, needs partner approval, cannot take card guarantees, and has no public status page, changelog or published prices.", "bestFor": "CRM, PMS and AI phone-agent vendors and restaurant groups that run on TheFork Manager, mainly in Europe.", "strengths": [ "OpenAPI 3.1 schema generated from the deployed code, with 19 operations, enums, examples and error responses", "llms.txt for the B2B API covers scopes per endpoint, time zones, reservation statuses and error formats", "Nine OAuth scopes, including read-only availability and a separate scope for unrestricted bookings that is off by default", "Business error codes such as NO_AVAILABILITY, DOUBLE_BOOKING and RESERVATION_NOT_FOUND", "Written versioning policy with 6 months of support for the previous version" ], "weaknesses": [ "Venue-side only. Credentials cover the restaurants that granted access, and no endpoint lists restaurants", "Credentials come from the integrations team by email after approval, with no self-serve route", "Timeslots that need a payment guarantee cannot be booked through the API", "The status page at status.thefork.io redirects to a private Rootly page that needs a sign-in", "No changelog, idempotency key or published production rate limit" ], "agentNotes": [ "Read hasPaymentGuaranteeRequirement in the timeslots response before booking, since the API cannot take a card", "Check the status field after creating a reservation and treat REQUESTED as unconfirmed", "Send the timeslot datetime unchanged as mealDate, because times are the restaurant's local time", "Check for an existing reservation before retrying a failed POST, as no idempotency key exists and 409 signals DOUBLE_BOOKING", "Cache the access token for its 8,600 seconds and do not request a new one while it is valid" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43.6 } ], "editorialScores": { "ergonomics": 56, "maintenance": 15, "payments": 5, "reliability": 35, "schema": 87, "security": 42, "transparency": 33 }, "provenanceScore": 60 }, "connect": { "http": "curl -X POST https://auth.thefork.io/oauth/token -H 'Content-Type: application/x-www-form-urlencoded' -d 'audience=https://api.thefork.io\u0026grant_type=client_credentials\u0026client_id=CLIENT_ID\u0026client_secret=CLIENT_SECRET'" }, "letme": { "capability": "https://letme.dev/booking.reservations", "tool": "https://letme.dev/thefork" }, "notable": [ "The OpenAPI 3.1 schema is generated from the deployed code and lists 19 operations, each with a description and documented error responses (https://api.thefork.io/manager/openapi.json)", "The B2B llms.txt tells agents to trust the schema over the reference pages, and spells out scopes per endpoint, time zone rules and error formats (https://docs.thefork.io/B2B-API/llms.txt)", "A 200 on POST /v1/restaurants/{id}/reservations does not mean confirmed. RECORDED is confirmed and REQUESTED awaits the restaurant (https://docs.thefork.io/B2B-API/llms.txt)", "The API cannot take a payment guarantee. Booking a timeslot that needs one returns 400 PAYMENT_GUARANTEE_NOT_SUPPORTED (https://docs.thefork.io/B2B-API/llms.txt)", "Every cancellation through the API is recorded as a cancellation by the restaurant (https://docs.thefork.io/B2B-API/llms.txt)", "A breaking change creates a new version, and the previous version is supported for 6 months after it (https://docs.thefork.io/getting-started)", "The Partners API terms set a default of 200 calls a minute and 10,000 a day and ask partners to keep errors under 10 per cent of bookings (https://docs.thefork.io/pdf/LaFourchette-Partners-API-Licence-2.pdf)" ], "area": "everyday", "details": [ { "label": "Surface graded", "value": "The B2B API (TheFork Manager) at https://api.thefork.io/manager/v1. The separate POS API is not graded. The portal's partner section is marked available soon. No official MCP server was found" }, { "label": "Diner or venue", "value": "Venue. The API acts for restaurants and restaurant groups, or for software vendors they authorise, on TheFork Manager" }, { "label": "Endpoints", "value": "Booking flow (availabilities, timeslots, party sizes, promotions and set menus, availability override, create, update and cancel reservation), data (reservations and customers), reviews and replies, phone (customer by phone, caller ID, integration status)" }, { "label": "Credentials", "value": "OAuth 2.0 client credentials from auth.thefork.io, Bearer token valid 8,600 seconds, nine scopes listed in the schema" }, { "label": "Rate limits", "value": "Set by contract and not stated in the docs. The Partners API terms give 200 calls a minute and 10,000 a day by default. 429 with exponential backoff advised" }, { "label": "Errors", "value": "Three formats. API errors carry statusCode, error and data.code. Gateway errors (401, 403, 429, 503) carry only a message. Token errors use error and error_description" }, { "label": "Webhooks", "value": "Activated by TheFork for a URL you send them. Payloads carry entityType, uuid and eventType for customers, reservations and reviews. Acknowledge with 200 or the event is resent" }, { "label": "Deposits", "value": "No payment field on booking. Timeslots that need a payment guarantee return 400 PAYMENT_GUARANTEE_NOT_SUPPORTED" }, { "label": "Versioning", "value": "One version (v1) for the whole API. A breaking change creates a new version, and the old one is supported for 6 months" } ], "provenance": { "legalEntity": "La Fourchette SAS", "domain": "thefork.io", "domainRegistered": "2016-05-30", "endpointOnVendorDomain": true, "terms": "https://docs.thefork.io/pdf/LaFourchette-Partners-API-Licence-2.pdf", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The developer portal footer links the TheFork Partners API Terms of Use, a PDF naming La Fourchette SAS, 70 rue Saint Lazare, Paris, company number 494 447 949, where no core agreement exists.", "www.thefork.com answered with a bot check (403), so its privacy policy and terms were not read and no privacy URL is recorded.", "status.thefork.io redirects to a private Rootly status page that needs a sign-in, so no public status page is recorded.", "www.thefork.com/.well-known/security.txt returns 404 and docs.thefork.io/.well-known/security.txt returns 403.", "No changelog was found. docs.thefork.io/changelog returns 403.", "RDAP gives thefork.io a registration date of 2016-05-30 and thefork.com 1998-11-04." ], "score": 60, "checks": [ { "check": "Legal entity named", "value": "La Fourchette SAS", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "thefork.io, registered 2016-05-30 (10 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.thefork.io", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/thefork.json", "live": { "slug": "thefork", "probe": { "target": "https://api.thefork.io/manager", "method": "get", "lastAt": "2026-10-14T09:42:10.255461561Z", "lastOk": true, "lastStatus": 404, "lastMs": 57, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 56, "p95ms24h": 119, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "updatedAt": "2026-10-14T09:42:10.255461561Z" } } }