{ "data": { "similar": [ { "grade": "D", "json": "https://www.anchorterminal.com/tools/eat-app.json", "name": "Eat App Partner API", "score": 53.4, "shared": [ "booking.reservations", "booking.availability", "booking.venue", "crm.records", "events.webhooks-send" ], "slug": "eat-app" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/opentable.json", "name": "OpenTable APIs", "score": 38.6, "shared": [ "booking.availability", "booking.reservations", "booking.venue", "crm.records" ], "slug": "opentable" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/sevenrooms.json", "name": "SevenRooms", "score": 17.7, "shared": [ "booking.venue", "booking.reservations", "booking.availability", "crm.records" ], "slug": "sevenrooms" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/tablecheck.json", "name": "TableCheck API", "score": 57.1, "shared": [ "booking.availability", "booking.reservations", "booking.venue" ], "slug": "tablecheck" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/resy.json", "name": "Resy", "score": 10.3, "shared": [ "booking.reservations", "booking.availability", "booking.venue" ], "slug": "resy" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/square-appointments.json", "name": "Square Appointments (Bookings API)", "score": 68.1, "shared": [ "booking.availability", "booking.venue" ], "slug": "square-appointments" } ], "tool": { "slug": "thefork", "name": "TheFork B2B API", "vendor": "TheFork (La Fourchette SAS)", "vendorUrl": "https://www.thefork.com", "kind": "http-api", "category": "local-bookings", "summary": "TheFork's B2B API lets restaurants and their software partners, such as CRM vendors and AI phone agents, read availability and create, change and cancel reservations in TheFork Manager, with webhooks, reviews and customer data.", "url": "https://www.anchorterminal.com/tools/thefork", "markdownUrl": "https://www.anchorterminal.com/tools/thefork.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/thefork.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/thefork.json", "license": "Proprietary service under TheFork Partners API Terms of Use (La Fourchette SAS) and any core agreement with TheFork", "transports": [ "http" ], "remoteUrl": "https://api.thefork.io/manager", "packages": [], "auth": "oauth", "authNotes": "Partner approval required. Credentials are requested from the integrations team at integrations@thefork.com with a company name and use case. TheFork sends a client_id and client_secret through a secure channel, and the client exchanges them at https://auth.thefork.io/oauth/token (OAuth 2.0 client credentials, audience https://api.thefork.io) for a Bearer token that lasts 8,600 seconds. Nine scopes limit each client, from full access (tfm-restaurant) to read-only availability. restaurantUuid and groupUuid values for each restaurant come from TheFork, as no endpoint lists them.", "pricing": "byo-plan", "pricingNotes": "No API prices are published. Access follows a partnership with TheFork, and the rate limit is set by contract. The API terms mention test data for pre-launch testing. No sandbox host or self-serve tier is documented (https://docs.thefork.io/getting-started).", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer portal, llms.txt or OpenAPI schema (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.thefork.io/B2B-API/introduction", "llmsTxt": "https://docs.thefork.io/B2B-API/llms.txt", "openapi": "https://api.thefork.io/manager/openapi.json", "capabilities": [ "booking.reservations", "booking.availability", "booking.venue", "crm.records", "events.webhooks-send" ], "tags": [ "hosted", "closed-source", "partner-only", "rest", "oauth", "openapi", "llms-txt", "webhooks", "eu", "restaurants" ], "graded": true, "anchor": { "graded": true, "score": 43.6, "grade": "E", "agentReady": false, "rank": 951, "ranked": true, "rankOf": 1076, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 56, "maintenance": 15, "payments": 5, "reliability": 35, "schema": 87, "security": 42, "transparency": 47 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 35, "points": 7, "reason": "Graded as a hosted API. status.thefork.io redirects to a private Rootly page behind a sign-in, so there is no public status page (0) and no readable history (5). The docs leave the rate limit to each contract. The Partners API terms set 200 calls a minute and 10,000 a day by default, which we take as published numbers for part of the line (8 of 15). 429 and 503 call for exponential backoff, and the llms.txt says to check the current state before retrying a POST or PATCH, but no idempotency key exists (12 of 15). No SLA, and the terms disclaim uptime (0). v1 is generally available (10). Total 35." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 87, "points": 14.14, "reason": "OpenAPI 3.1.0 schema at api.thefork.io/manager/openapi.json, generated from the deployed code, with 19 operations and the scopes (25). A B2B llms.txt written for agents (10). Every operation has a description, and the llms.txt says when to use each and which pages to ignore, though per-endpoint when-not-to-use guidance is thin (16 of 20). 319 enums and required fields across the schema, with the E.164 phone pattern stated (14 of 15). 272 examples, error responses on every operation and three error formats explained (14 of 15). One version in the path with a written policy of 6 months' support after a breaking change, but no changelog (8 of 15). Total 87." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 56, "points": 9.1, "reason": "List endpoints return UUIDs only and need one detail call per item, which keeps lists small but multiplies calls. No field selection (12 of 25). page and limit with totalCount or hasNext, and date filters on every list (16). Business codes in data.code (NO_AVAILABILITY, DOUBLE_BOOKING, PAYMENT_GUARANTEE_NOT_SUPPORTED), but gateway errors carry only a message and three formats must be parsed (15). No idempotency key. 409 DOUBLE_BOOKING and DOUBLE_CANCELLATION catch repeats, and the docs say to check state before retrying writes (8 of 20). No SDKs, five required customer fields, and restaurant UUIDs must come from TheFork because no endpoint lists them (5). Total 56." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 42, "points": 7.35, "reason": "OAuth 2.0 client credentials with nine scopes in the schema, from full access down to read-only availability. The secret is delivered through a secure channel. No rotation procedure was found (25 of 30). Read-only scopes exist, and tfm-restaurant:unrestricted-reservations, which books outside published slots, is not granted by default (14 of 20). Responses carry review text and customer data written by people, and the best-practices page covers input sanitisation but not untrusted output (3). No audit log or per-call view found (0). www.thefork.com/.well-known/security.txt returns 404, the main site answered with a bot check, and no SOC 2, ISO 27001 or disclosure programme was found in the developer portal (0). Total 42." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 5, "points": 0.63, "reason": "No x402, MPP or L402 (0). No API prices published (0). The API terms mention test data before launch, but no sandbox host or free tier is documented, and both follow approval (5 of 20). A person emails the integrations team and TheFork sends credentials (0). Total 5." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 15, "points": 1.31, "reason": "No changelog or dated release notes. The developer portal files, including the llms.txt, carry a Last-Modified date of 5 October 2026, which shows a recent docs deployment but not what changed, so it earns part of the line (10 of 30). No three dated changes in 90 days (0). An integrations email address, no public issue tracker or community channel (5 of 15). No official SDKs (0). No package to assess (0). Total 15." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 47, "points": 4.11, "note": "editorial 33, provenance 60", "reason": "Closed service. The Partners API terms are a public PDF naming La Fourchette SAS, though they describe an affiliate Partners API and defer to any core agreement (15 of 30). The terms cover data ownership and credential use. The privacy policy on www.thefork.com was behind a bot check, so retention and processing statements were unread (3 of 30). A written versioning policy with 6 months' support for the previous version, without dated notices (15 of 20). No subprocessor list or data locations found (0). Total 33." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "List endpoints return UUIDs only and need one detail call per item, which keeps lists small but multiplies calls. No field selection (12 of 25). page and limit with totalCount or hasNext, and date filters on every list (16). Business codes in data.code (NO_AVAILABILITY, DOUBLE_BOOKING, PAYMENT_GUARANTEE_NOT_SUPPORTED), but gateway errors carry only a message and three formats must be parsed (15). No idempotency key. 409 DOUBLE_BOOKING and DOUBLE_CANCELLATION catch repeats, and the docs say to check state before retrying writes (8 of 20). No SDKs, five required customer fields, and restaurant UUIDs must come from TheFork because no endpoint lists them (5). Total 56.", "maintenance": "No changelog or dated release notes. The developer portal files, including the llms.txt, carry a Last-Modified date of 5 October 2026, which shows a recent docs deployment but not what changed, so it earns part of the line (10 of 30). No three dated changes in 90 days (0). An integrations email address, no public issue tracker or community channel (5 of 15). No official SDKs (0). No package to assess (0). Total 15.", "payments": "No x402, MPP or L402 (0). No API prices published (0). The API terms mention test data before launch, but no sandbox host or free tier is documented, and both follow approval (5 of 20). A person emails the integrations team and TheFork sends credentials (0). Total 5.", "reliability": "Graded as a hosted API. status.thefork.io redirects to a private Rootly page behind a sign-in, so there is no public status page (0) and no readable history (5). The docs leave the rate limit to each contract. The Partners API terms set 200 calls a minute and 10,000 a day by default, which we take as published numbers for part of the line (8 of 15). 429 and 503 call for exponential backoff, and the llms.txt says to check the current state before retrying a POST or PATCH, but no idempotency key exists (12 of 15). No SLA, and the terms disclaim uptime (0). v1 is generally available (10). Total 35.", "schema": "OpenAPI 3.1.0 schema at api.thefork.io/manager/openapi.json, generated from the deployed code, with 19 operations and the scopes (25). A B2B llms.txt written for agents (10). Every operation has a description, and the llms.txt says when to use each and which pages to ignore, though per-endpoint when-not-to-use guidance is thin (16 of 20). 319 enums and required fields across the schema, with the E.164 phone pattern stated (14 of 15). 272 examples, error responses on every operation and three error formats explained (14 of 15). One version in the path with a written policy of 6 months' support after a breaking change, but no changelog (8 of 15). Total 87.", "security": "OAuth 2.0 client credentials with nine scopes in the schema, from full access down to read-only availability. The secret is delivered through a secure channel. No rotation procedure was found (25 of 30). Read-only scopes exist, and tfm-restaurant:unrestricted-reservations, which books outside published slots, is not granted by default (14 of 20). Responses carry review text and customer data written by people, and the best-practices page covers input sanitisation but not untrusted output (3). No audit log or per-call view found (0). www.thefork.com/.well-known/security.txt returns 404, the main site answered with a bot check, and no SOC 2, ISO 27001 or disclosure programme was found in the developer portal (0). Total 42.", "transparency": "Closed service. The Partners API terms are a public PDF naming La Fourchette SAS, though they describe an affiliate Partners API and defer to any core agreement (15 of 30). The terms cover data ownership and credential use. The privacy policy on www.thefork.com was behind a bot check, so retention and processing statements were unread (3 of 30). A written versioning policy with 6 months' support for the previous version, without dated notices (15 of 20). No subprocessor list or data locations found (0). Total 33." }, "sources": [ { "what": "B2B API llms.txt", "url": "https://docs.thefork.io/B2B-API/llms.txt", "seen": "2026-10-14" }, { "what": "OpenAPI schema", "url": "https://api.thefork.io/manager/openapi.json", "seen": "2026-10-14" }, { "what": "getting started, versioning and rate limiting", "url": "https://docs.thefork.io/getting-started", "seen": "2026-10-14" }, { "what": "preliminary steps and credentials", "url": "https://docs.thefork.io/preliminary-steps", "seen": "2026-10-14" }, { "what": "B2B introduction", "url": "https://docs.thefork.io/B2B-API/introduction", "seen": "2026-10-14" }, { "what": "best practices", "url": "https://docs.thefork.io/best-practices", "seen": "2026-10-14" }, { "what": "Partners API terms of use (PDF)", "url": "https://docs.thefork.io/pdf/LaFourchette-Partners-API-Licence-2.pdf", "seen": "2026-10-14" }, { "what": "status page redirect (private Rootly page)", "url": "https://status.thefork.io/", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: www.thefork.com answered every request with a bot check (403), so its privacy policy, terms of use and any security or disclosure page were not read", "unchecked: TheFork's status history, which sits on a private Rootly status page", "Whether a sandbox exists for the B2B API. The terms mention test data, but no sandbox host is documented", "Whether the Partners API terms PDF, written for affiliate partners, is the licence for the B2B API. The portal footer links it as the terms of use", "Whether client secrets can be rotated on request" ] }, "negative": 0, "verdict": "A venue-side API with a generated OpenAPI 3.1 schema, an llms.txt written for agents and nine OAuth scopes down to read-only availability. It acts for restaurants and their vendors, not diners, needs partner approval, cannot take card guarantees, and has no public status page, changelog or published prices.", "bestFor": "CRM, PMS and AI phone-agent vendors and restaurant groups that run on TheFork Manager, mainly in Europe.", "strengths": [ "OpenAPI 3.1 schema generated from the deployed code, with 19 operations, enums, examples and error responses", "llms.txt for the B2B API covers scopes per endpoint, time zones, reservation statuses and error formats", "Nine OAuth scopes, including read-only availability and a separate scope for unrestricted bookings that is off by default", "Business error codes such as NO_AVAILABILITY, DOUBLE_BOOKING and RESERVATION_NOT_FOUND", "Written versioning policy with 6 months of support for the previous version" ], "weaknesses": [ "Venue-side only. Credentials cover the restaurants that granted access, and no endpoint lists restaurants", "Credentials come from the integrations team by email after approval, with no self-serve route", "Timeslots that need a payment guarantee cannot be booked through the API", "The status page at status.thefork.io redirects to a private Rootly page that needs a sign-in", "No changelog, idempotency key or published production rate limit" ], "agentNotes": [ "Read hasPaymentGuaranteeRequirement in the timeslots response before booking, since the API cannot take a card", "Check the status field after creating a reservation and treat REQUESTED as unconfirmed", "Send the timeslot datetime unchanged as mealDate, because times are the restaurant's local time", "Check for an existing reservation before retrying a failed POST, as no idempotency key exists and 409 signals DOUBLE_BOOKING", "Cache the access token for its 8,600 seconds and do not request a new one while it is valid" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43.6 } ], "editorialScores": { "ergonomics": 56, "maintenance": 15, "payments": 5, "reliability": 35, "schema": 87, "security": 42, "transparency": 33 }, "provenanceScore": 60 }, "connect": { "http": "curl -X POST https://auth.thefork.io/oauth/token -H 'Content-Type: application/x-www-form-urlencoded' -d 'audience=https://api.thefork.io\u0026grant_type=client_credentials\u0026client_id=CLIENT_ID\u0026client_secret=CLIENT_SECRET'" }, "letme": { "capability": "https://letme.dev/booking.reservations", "tool": "https://letme.dev/thefork" }, "notable": [ "The OpenAPI 3.1 schema is generated from the deployed code and lists 19 operations, each with a description and documented error responses (https://api.thefork.io/manager/openapi.json)", "The B2B llms.txt tells agents to trust the schema over the reference pages, and spells out scopes per endpoint, time zone rules and error formats (https://docs.thefork.io/B2B-API/llms.txt)", "A 200 on POST /v1/restaurants/{id}/reservations does not mean confirmed. RECORDED is confirmed and REQUESTED awaits the restaurant (https://docs.thefork.io/B2B-API/llms.txt)", "The API cannot take a payment guarantee. Booking a timeslot that needs one returns 400 PAYMENT_GUARANTEE_NOT_SUPPORTED (https://docs.thefork.io/B2B-API/llms.txt)", "Every cancellation through the API is recorded as a cancellation by the restaurant (https://docs.thefork.io/B2B-API/llms.txt)", "A breaking change creates a new version, and the previous version is supported for 6 months after it (https://docs.thefork.io/getting-started)", "The Partners API terms set a default of 200 calls a minute and 10,000 a day and ask partners to keep errors under 10 per cent of bookings (https://docs.thefork.io/pdf/LaFourchette-Partners-API-Licence-2.pdf)" ], "area": "everyday", "details": [ { "label": "Surface graded", "value": "The B2B API (TheFork Manager) at https://api.thefork.io/manager/v1. The separate POS API is not graded. The portal's partner section is marked available soon. No official MCP server was found" }, { "label": "Diner or venue", "value": "Venue. The API acts for restaurants and restaurant groups, or for software vendors they authorise, on TheFork Manager" }, { "label": "Endpoints", "value": "Booking flow (availabilities, timeslots, party sizes, promotions and set menus, availability override, create, update and cancel reservation), data (reservations and customers), reviews and replies, phone (customer by phone, caller ID, integration status)" }, { "label": "Credentials", "value": "OAuth 2.0 client credentials from auth.thefork.io, Bearer token valid 8,600 seconds, nine scopes listed in the schema" }, { "label": "Rate limits", "value": "Set by contract and not stated in the docs. The Partners API terms give 200 calls a minute and 10,000 a day by default. 429 with exponential backoff advised" }, { "label": "Errors", "value": "Three formats. API errors carry statusCode, error and data.code. Gateway errors (401, 403, 429, 503) carry only a message. Token errors use error and error_description" }, { "label": "Webhooks", "value": "Activated by TheFork for a URL you send them. Payloads carry entityType, uuid and eventType for customers, reservations and reviews. Acknowledge with 200 or the event is resent" }, { "label": "Deposits", "value": "No payment field on booking. Timeslots that need a payment guarantee return 400 PAYMENT_GUARANTEE_NOT_SUPPORTED" }, { "label": "Versioning", "value": "One version (v1) for the whole API. A breaking change creates a new version, and the old one is supported for 6 months" } ], "provenance": { "legalEntity": "La Fourchette SAS", "domain": "thefork.io", "domainRegistered": "2016-05-30", "endpointOnVendorDomain": true, "terms": "https://docs.thefork.io/pdf/LaFourchette-Partners-API-Licence-2.pdf", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The developer portal footer links the TheFork Partners API Terms of Use, a PDF naming La Fourchette SAS, 70 rue Saint Lazare, Paris, company number 494 447 949, where no core agreement exists.", "www.thefork.com answered with a bot check (403), so its privacy policy and terms were not read and no privacy URL is recorded.", "status.thefork.io redirects to a private Rootly status page that needs a sign-in, so no public status page is recorded.", "www.thefork.com/.well-known/security.txt returns 404 and docs.thefork.io/.well-known/security.txt returns 403.", "No changelog was found. docs.thefork.io/changelog returns 403.", "RDAP gives thefork.io a registration date of 2016-05-30 and thefork.com 1998-11-04." ], "score": 60, "checks": [ { "check": "Legal entity named", "value": "La Fourchette SAS", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "thefork.io, registered 2016-05-30 (10 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.thefork.io", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/thefork.json", "live": { "slug": "thefork", "probe": { "target": "https://api.thefork.io/manager", "method": "get", "lastAt": "2026-10-14T09:42:10.255461561Z", "lastOk": true, "lastStatus": 404, "lastMs": 57, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 56, "p95ms24h": 119, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "updatedAt": "2026-10-14T09:42:10.255461561Z" } }, "verify": { "accepts": "a page on thefork.io or thefork.com or one of their subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/thefork.svg", "body": { "slug": "thefork", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/thefork", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/thefork\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/thefork.svg\" alt=\"TheFork B2B API on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![TheFork B2B API on Anchor Terminal](https://www.anchorterminal.com/badges/thefork.svg)](https://www.anchorterminal.com/tools/thefork)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/thefork\"\u003eTheFork B2B API on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/thefork", "json": "https://www.anchorterminal.com/tools/thefork.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/thefork.md", "slim": "https://www.anchorterminal.com/tools/thefork.min.md" }, "markdown": "## Overview\n\n**Grade E · 43.6/100 · rank #951 of 1076 · #4 in Restaurant \u0026 local bookings · not agent-ready · confidence medium**\n\n\n## Assessment\n\nA venue-side API with a generated OpenAPI 3.1 schema, an llms.txt written for agents and nine OAuth scopes down to read-only availability. It acts for restaurants and their vendors, not diners, needs partner approval, cannot take card guarantees, and has no public status page, changelog or published prices.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | TheFork (La Fourchette SAS) (https://www.thefork.com) |\n| Kind | HTTP API |\n| Category | Restaurant \u0026 local bookings (https://www.anchorterminal.com/categories/local-bookings) |\n| Transport | HTTP |\n| Endpoint | `https://api.thefork.io/manager` |\n| Auth | OAuth · Partner approval required. Credentials are requested from the integrations team at integrations@thefork.com with a company name and use case. TheFork sends a client_id and client_secret through a secure channel, and the client exchanges them at https://auth.thefork.io/oauth/token (OAuth 2.0 client credentials, audience https://api.thefork.io) for a Bearer token that lasts 8,600 seconds. Nine scopes limit each client, from full access (tfm-restaurant) to read-only availability. restaurantUuid and groupUuid values for each restaurant come from TheFork, as no endpoint lists them. |\n| Pricing | Your plan (Your plan) · No API prices are published. Access follows a partnership with TheFork, and the rate limit is set by contract. The API terms mention test data for pre-launch testing. No sandbox host or self-serve tier is documented (https://docs.thefork.io/getting-started). |\n| x402 | No · No x402, MPP or L402 in the developer portal, llms.txt or OpenAPI schema (checked 2026-10-14). |\n| Licence | Proprietary service under TheFork Partners API Terms of Use (La Fourchette SAS) and any core agreement with TheFork |\n| Docs | https://docs.thefork.io/B2B-API/introduction |\n| llms.txt | https://docs.thefork.io/B2B-API/llms.txt |\n| Surface graded | The B2B API (TheFork Manager) at https://api.thefork.io/manager/v1. The separate POS API is not graded. The portal's partner section is marked available soon. No official MCP server was found |\n| Diner or venue | Venue. The API acts for restaurants and restaurant groups, or for software vendors they authorise, on TheFork Manager |\n| Endpoints | Booking flow (availabilities, timeslots, party sizes, promotions and set menus, availability override, create, update and cancel reservation), data (reservations and customers), reviews and replies, phone (customer by phone, caller ID, integration status) |\n| Credentials | OAuth 2.0 client credentials from auth.thefork.io, Bearer token valid 8,600 seconds, nine scopes listed in the schema |\n| Rate limits | Set by contract and not stated in the docs. The Partners API terms give 200 calls a minute and 10,000 a day by default. 429 with exponential backoff advised |\n| Errors | Three formats. API errors carry statusCode, error and data.code. Gateway errors (401, 403, 429, 503) carry only a message. Token errors use error and error_description |\n| Webhooks | Activated by TheFork for a URL you send them. Payloads carry entityType, uuid and eventType for customers, reservations and reviews. Acknowledge with 200 or the event is resent |\n| Deposits | No payment field on booking. Timeslots that need a payment guarantee return 400 PAYMENT_GUARANTEE_NOT_SUPPORTED |\n| Versioning | One version (v1) for the whole API. A breaking change creates a new version, and the old one is supported for 6 months |\n| Capabilities | booking.reservations, booking.availability, booking.venue, crm.records, events.webhooks-send |\n| Tags | hosted, closed-source, partner-only, rest, oauth, openapi, llms-txt, webhooks, eu, restaurants |\n| JSON | https://www.anchorterminal.com/api/v1/tools/thefork.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 35 | 7.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 87 | 14.1 |\n| Agent ergonomics | 13% | 16.2 | 56 | 9.1 |\n| Security \u0026 auth | 14% | 17.5 | 42 | 7.3 |\n| Payments \u0026 pricing | 10% | 12.5 | 5 | 0.6 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 15 | 1.3 |\n| Transparency \u0026 trust (editorial 33, provenance 60) | 7% | 8.8 | 47 | 4.1 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **43.6 → E** |\n\n### Why each score\n\n- Reliability 35: Graded as a hosted API. status.thefork.io redirects to a private Rootly page behind a sign-in, so there is no public status page (0) and no readable history (5). The docs leave the rate limit to each contract. The Partners API terms set 200 calls a minute and 10,000 a day by default, which we take as published numbers for part of the line (8 of 15). 429 and 503 call for exponential backoff, and the llms.txt says to check the current state before retrying a POST or PATCH, but no idempotency key exists (12 of 15). No SLA, and the terms disclaim uptime (0). v1 is generally available (10). Total 35.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 87: OpenAPI 3.1.0 schema at api.thefork.io/manager/openapi.json, generated from the deployed code, with 19 operations and the scopes (25). A B2B llms.txt written for agents (10). Every operation has a description, and the llms.txt says when to use each and which pages to ignore, though per-endpoint when-not-to-use guidance is thin (16 of 20). 319 enums and required fields across the schema, with the E.164 phone pattern stated (14 of 15). 272 examples, error responses on every operation and three error formats explained (14 of 15). One version in the path with a written policy of 6 months' support after a breaking change, but no changelog (8 of 15). Total 87.\n- Agent ergonomics 56: List endpoints return UUIDs only and need one detail call per item, which keeps lists small but multiplies calls. No field selection (12 of 25). page and limit with totalCount or hasNext, and date filters on every list (16). Business codes in data.code (NO_AVAILABILITY, DOUBLE_BOOKING, PAYMENT_GUARANTEE_NOT_SUPPORTED), but gateway errors carry only a message and three formats must be parsed (15). No idempotency key. 409 DOUBLE_BOOKING and DOUBLE_CANCELLATION catch repeats, and the docs say to check state before retrying writes (8 of 20). No SDKs, five required customer fields, and restaurant UUIDs must come from TheFork because no endpoint lists them (5). Total 56.\n- Security \u0026 auth 42: OAuth 2.0 client credentials with nine scopes in the schema, from full access down to read-only availability. The secret is delivered through a secure channel. No rotation procedure was found (25 of 30). Read-only scopes exist, and tfm-restaurant:unrestricted-reservations, which books outside published slots, is not granted by default (14 of 20). Responses carry review text and customer data written by people, and the best-practices page covers input sanitisation but not untrusted output (3). No audit log or per-call view found (0). www.thefork.com/.well-known/security.txt returns 404, the main site answered with a bot check, and no SOC 2, ISO 27001 or disclosure programme was found in the developer portal (0). Total 42.\n- Payments \u0026 pricing 5: No x402, MPP or L402 (0). No API prices published (0). The API terms mention test data before launch, but no sandbox host or free tier is documented, and both follow approval (5 of 20). A person emails the integrations team and TheFork sends credentials (0). Total 5.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 15: No changelog or dated release notes. The developer portal files, including the llms.txt, carry a Last-Modified date of 5 October 2026, which shows a recent docs deployment but not what changed, so it earns part of the line (10 of 30). No three dated changes in 90 days (0). An integrations email address, no public issue tracker or community channel (5 of 15). No official SDKs (0). No package to assess (0). Total 15.\n- Transparency \u0026 trust 47: Closed service. The Partners API terms are a public PDF naming La Fourchette SAS, though they describe an affiliate Partners API and defer to any core agreement (15 of 30). The terms cover data ownership and credential use. The privacy policy on www.thefork.com was behind a bot check, so retention and processing statements were unread (3 of 30). A written versioning policy with 6 months' support for the previous version, without dated notices (15 of 20). No subprocessor list or data locations found (0). Total 33.\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (16 items): https://www.anchorterminal.com/fixes/thefork.md (JSON https://www.anchorterminal.com/fixes/thefork.json)\n\n### What we couldn't check\n\n- unchecked: www.thefork.com answered every request with a bot check (403), so its privacy policy, terms of use and any security or disclosure page were not read\n- unchecked: TheFork's status history, which sits on a private Rootly status page\n- Whether a sandbox exists for the B2B API. The terms mention test data, but no sandbox host is documented\n- Whether the Partners API terms PDF, written for affiliate partners, is the licence for the B2B API. The portal footer links it as the terms of use\n- Whether client secrets can be rotated on request\n\n### Sources\n\n- B2B API llms.txt: \u003chttps://docs.thefork.io/B2B-API/llms.txt\u003e (seen 2026-10-14)\n- OpenAPI schema: \u003chttps://api.thefork.io/manager/openapi.json\u003e (seen 2026-10-14)\n- getting started, versioning and rate limiting: \u003chttps://docs.thefork.io/getting-started\u003e (seen 2026-10-14)\n- preliminary steps and credentials: \u003chttps://docs.thefork.io/preliminary-steps\u003e (seen 2026-10-14)\n- B2B introduction: \u003chttps://docs.thefork.io/B2B-API/introduction\u003e (seen 2026-10-14)\n- best practices: \u003chttps://docs.thefork.io/best-practices\u003e (seen 2026-10-14)\n- Partners API terms of use (PDF): \u003chttps://docs.thefork.io/pdf/LaFourchette-Partners-API-Licence-2.pdf\u003e (seen 2026-10-14)\n- status page redirect (private Rootly page): \u003chttps://status.thefork.io/\u003e (seen 2026-10-14)\n\n## Who's behind it (provenance 60/100, checked 2026-10-14)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | La Fourchette SAS | 20/20 |\n| Domain age | thefork.io, registered 2016-05-30 (10 years) | 15/15 |\n| Endpoint on the vendor's domain | api.thefork.io | 15/15 |\n| Terms of service | published | 10/10 |\n| Privacy policy | not found | 0/10 |\n| Status page | not found | 0/10 |\n| Changelog | not found | 0/10 |\n| security.txt | not found | 0/10 |\n\nThe developer portal footer links the TheFork Partners API Terms of Use, a PDF naming La Fourchette SAS, 70 rue Saint Lazare, Paris, company number 494 447 949, where no core agreement exists.\n\nwww.thefork.com answered with a bot check (403), so its privacy policy and terms were not read and no privacy URL is recorded.\n\nstatus.thefork.io redirects to a private Rootly status page that needs a sign-in, so no public status page is recorded.\n\nwww.thefork.com/.well-known/security.txt returns 404 and docs.thefork.io/.well-known/security.txt returns 403.\n\nNo changelog was found. docs.thefork.io/changelog returns 403.\n\nRDAP gives thefork.io a registration date of 2016-05-30 and thefork.com 1998-11-04.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://docs.thefork.io/pdf/LaFourchette-Partners-API-Licence-2.pdf), not read yet.\n\n\n**Privacy policy**. We found no privacy policy published for this product, so there is nothing to read and the check scores 0.\n\n\n## Live (updated 2026-10-14 09:42 UTC)\n\n- Right now: up, HTTP 404, 57 ms, checked 2026-10-14 09:42 UTC (get on `https://api.thefork.io/manager`)\n- Uptime 24h 100.0% (17 probes) · 30 days 100.0% (17 probes) · p50 56 ms · p95 119 ms\n- Always current: https://www.anchorterminal.com/api/v1/live/thefork.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- OpenAPI 3.1 schema generated from the deployed code, with 19 operations, enums, examples and error responses\n- llms.txt for the B2B API covers scopes per endpoint, time zones, reservation statuses and error formats\n- Nine OAuth scopes, including read-only availability and a separate scope for unrestricted bookings that is off by default\n- Business error codes such as NO_AVAILABILITY, DOUBLE_BOOKING and RESERVATION_NOT_FOUND\n- Written versioning policy with 6 months of support for the previous version\n\n## Weaknesses\n\n- Venue-side only. Credentials cover the restaurants that granted access, and no endpoint lists restaurants\n- Credentials come from the integrations team by email after approval, with no self-serve route\n- Timeslots that need a payment guarantee cannot be booked through the API\n- The status page at status.thefork.io redirects to a private Rootly page that needs a sign-in\n- No changelog, idempotency key or published production rate limit\n\n## Before you call it (notes for agents)\n\n1. Read hasPaymentGuaranteeRequirement in the timeslots response before booking, since the API cannot take a card\n2. Check the status field after creating a reservation and treat REQUESTED as unconfirmed\n3. Send the timeslot datetime unchanged as mealDate, because times are the restaurant's local time\n4. Check for an existing reservation before retrying a failed POST, as no idempotency key exists and 409 signals DOUBLE_BOOKING\n5. Cache the access token for its 8,600 seconds and do not request a new one while it is valid\n\n## Connect\n\nFirst request:\n\n```bash\ncurl -X POST https://auth.thefork.io/oauth/token -H 'Content-Type: application/x-www-form-urlencoded' -d 'audience=https://api.thefork.io\u0026grant_type=client_credentials\u0026client_id=CLIENT_ID\u0026client_secret=CLIENT_SECRET'\n```\n\nThrough letme (picks today, calling later): https://letme.dev/thefork. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Eat App Partner API | D | 53.4 | 752 | booking.reservations, booking.availability, booking.venue, crm.records, events.webhooks-send | no | https://www.anchorterminal.com/tools/eat-app.md |\n| OpenTable APIs | E | 38.6 | 994 | booking.availability, booking.reservations, booking.venue, crm.records | no | https://www.anchorterminal.com/tools/opentable.md |\n| SevenRooms | F | 17.7 | 1043 | booking.venue, booking.reservations, booking.availability, crm.records | no | https://www.anchorterminal.com/tools/sevenrooms.md |\n| TableCheck API | C | 57.1 | 661 | booking.availability, booking.reservations, booking.venue | no | https://www.anchorterminal.com/tools/tablecheck.md |\n| Resy | F | 10.3 | 1068 | booking.reservations, booking.availability, booking.venue | no | https://www.anchorterminal.com/tools/resy.md |\n| Square Appointments (Bookings API) | B | 68.1 | 242 | booking.availability, booking.venue | no | https://www.anchorterminal.com/tools/square-appointments.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The OpenAPI 3.1 schema is generated from the deployed code and lists 19 operations, each with a description and documented error responses (source: \u003chttps://api.thefork.io/manager/openapi.json\u003e)\n- The B2B llms.txt tells agents to trust the schema over the reference pages, and spells out scopes per endpoint, time zone rules and error formats (source: \u003chttps://docs.thefork.io/B2B-API/llms.txt\u003e)\n- A 200 on POST /v1/restaurants/{id}/reservations does not mean confirmed. RECORDED is confirmed and REQUESTED awaits the restaurant (source: \u003chttps://docs.thefork.io/B2B-API/llms.txt\u003e)\n- The API cannot take a payment guarantee. Booking a timeslot that needs one returns 400 PAYMENT_GUARANTEE_NOT_SUPPORTED (source: \u003chttps://docs.thefork.io/B2B-API/llms.txt\u003e)\n- Every cancellation through the API is recorded as a cancellation by the restaurant (source: \u003chttps://docs.thefork.io/B2B-API/llms.txt\u003e)\n- A breaking change creates a new version, and the previous version is supported for 6 months after it (source: \u003chttps://docs.thefork.io/getting-started\u003e)\n- The Partners API terms set a default of 200 calls a minute and 10,000 a day and ask partners to keep errors under 10 per cent of bookings (source: \u003chttps://docs.thefork.io/pdf/LaFourchette-Partners-API-Licence-2.pdf\u003e)\n\n- #4 of 9 in Best restaurant reservation and local appointment APIs for AI agents: https://www.anchorterminal.com/best/local-bookings/index.md\n- All 36 bookings comparisons: https://www.anchorterminal.com/compare/local-bookings/index.md\n\n## Compare\n\n- [Chope vs TheFork B2B API](https://www.anchorterminal.com/compare/chope-vs-thefork.md): F 13.3 vs E 43.6\n- [Eat App Partner API vs TheFork B2B API](https://www.anchorterminal.com/compare/eat-app-vs-thefork.md): D 53.4 vs E 43.6\n- [Resy vs TheFork B2B API](https://www.anchorterminal.com/compare/resy-vs-thefork.md): F 10.3 vs E 43.6\n- [TheFork B2B API vs Tock](https://www.anchorterminal.com/compare/thefork-vs-tock.md): E 43.6 vs F 12.4\n- [OpenTable APIs vs TheFork B2B API](https://www.anchorterminal.com/compare/opentable-vs-thefork.md): E 38.6 vs E 43.6\n- [Square Appointments (Bookings API) vs TheFork B2B API](https://www.anchorterminal.com/compare/square-appointments-vs-thefork.md): B 68.1 vs E 43.6\n- [TableCheck API vs TheFork B2B API](https://www.anchorterminal.com/compare/tablecheck-vs-thefork.md): C 57.1 vs E 43.6\n- [SevenRooms vs TheFork B2B API](https://www.anchorterminal.com/compare/sevenrooms-vs-thefork.md): F 17.7 vs E 43.6\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on thefork.io or thefork.com or one of their subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"thefork\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/thefork\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/thefork.svg\" alt=\"TheFork B2B API on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![TheFork B2B API on Anchor Terminal](https://www.anchorterminal.com/badges/thefork.svg)](https://www.anchorterminal.com/tools/thefork)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/thefork\"\u003eTheFork B2B API on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say TheFork B2B API is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/thefork-dark.png\n- Light: https://www.anchorterminal.com/assets/share/thefork-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=thefork\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Restaurant \u0026 local bookings", "url": "https://www.anchorterminal.com/categories/local-bookings" }, { "name": "TheFork B2B API", "url": "" } ], "description": "TheFork's B2B API lets restaurants and their software partners, such as CRM vendors and AI phone agents, read availability and create, change and cancel reservations in TheFork Manager, with webhooks, reviews and customer data.", "facts": [ "rank #951 of 1076", "OAuth auth", "0 desk reviews" ], "h1": "TheFork B2B API", "image": "https://www.anchorterminal.com/assets/og/tools-thefork.png", "path": "/tools/thefork", "published": "2026-10-01", "section": "tools", "title": "TheFork B2B review (2026): pricing, alternatives and grade E", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/tools/thefork" }, "tokens": { "markdown": 5450, "slim": 1580 }, "version": 1 }