All user requests (besides user creation) must be authenticated with the user's password. Authenticated requests simply have an additional HTTP header:

X-NAAMA-AUTHENTICATION: username="[email]", response="[hash code]", version="1"

The hash code above is a SHA256 digest, hex encoded, of a few pieces of information about the request.

hashcode = SHA256( SHA256([password]) + [email] + [uri] )

Notice that the password is first SHA256 digested, it is never sent across in clear text. The URI does not include the domain, so it would be something like /u/test@example.com . NB this authentication is in addition to the standard client authentication.

It returns JSON, on a successful order it will return

{ "_error":0, "order_id":"xxxxxxx" }

order_id: ordr.in's reference number for that order.

On an error it returns

{ "_error":1, "msg": "..." , "text":"..." }

The msg will be either:

• failed order: this indicates that something has gone wrong and the cc was not charged nor was the order passed to the restaurant
• transaction failed: this indicates an issue with creating a user (applicable only if ordr.in is handling user account management)

The text will be something end user viewable:

• If there are errors from the credit card processor we indicate what the error was
• Data validation errors "Please re-enter your address"
• Internal errors - generic errors when something has gone wrong in our internal processing