Venues

Venue management for operators. Every endpoint here is operator (client role, venue-scoped) unless noted - send an Authorization: Bearer token from the Authentication flow. Venue-scoped calls also check that your account can access the target venue and return 404 if not.

Method	Path	Purpose	Auth
GET	`/api/my-venues`	List venues you can access	operator
POST	`/api/my-venues`	Create a venue	operator
PUT	`/api/my-venues/:id`	Update venue settings	operator
PUT	`/api/my-venues/:id/status`	Switch draft/live	operator
POST	`/api/my-venues/:id/request-listing`	Request Sidedoor app listing	operator
POST	`/api/my-venues/:id/withdraw-listing`	Withdraw a pending listing	operator
GET	`/api/my-venues/:id/stats`	Per-venue stats	operator
GET	`/api/my-stats`	Cross-venue operator stats	operator
POST	`/api/venues/:id/logo`	Upload a venue logo	operator
DELETE	`/api/venues/:id/logo`	Remove the venue logo	operator

List venues

GET /api/my-venues returns the full venue records your account can access.

curl "https://thesidedoor.co/api/my-venues" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN"

const res = await fetch("https://thesidedoor.co/api/my-venues", {
  headers: { Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}` },
});
const { data } = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer {$token}"],
]);
$data = json_decode(curl_exec($ch), true);

{
  "data": [
    { "id": "VENUE_ID", "name": "The Blue Room", "status": "live", "app_listing_status": "approved" }
  ]
}

Create a venue

POST /api/my-venues. Only name and address are required; the rest are optional. Pass venue_type for a single type, or venue_types (an array) for a multi-type venue - the first entry becomes the primary type. food_types is stored only when the venue is a restaurant or cafe.

New venues are created status: "draft" with app_listing_status: "none" - they are not live yet. Complete the required details, then publish the venue with Switch draft/live. Getting listed in the Sidedoor consumer app is a separate step after that (see Request or withdraw an app listing).

curl -X POST "https://thesidedoor.co/api/my-venues" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"The Blue Room","address":"12 Example Street, London","venue_type":"bar","phone":"+442071234567","email":"hello@blueroom.example","backdoor_capacity":120,"queue_skip_price":10}'

const res = await fetch("https://thesidedoor.co/api/my-venues", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    name: "The Blue Room",
    address: "12 Example Street, London",
    venue_type: "bar",
    phone: "+442071234567",
    email: "hello@blueroom.example",
    backdoor_capacity: 120,
    queue_skip_price: 10,
  }),
});
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "name" => "The Blue Room",
    "address" => "12 Example Street, London",
    "venue_type" => "bar",
    "phone" => "+442071234567",
    "email" => "hello@blueroom.example",
    "backdoor_capacity" => 120,
    "queue_skip_price" => 10,
  ]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true, "id": "VENUE_ID", "status": "draft", "app_listing_status": "none" }

Update venue settings

PUT /api/my-venues/:id. Send only the fields you want to change - any field left out keeps its current value. The main body fields:

Field	Type	Notes
`venue_type`	string	primary type, e.g. `bar`, `restaurant`, `cafe`, `club`
`venue_types`	array	all types for a multi-type venue; first entry sets `venue_type`
`food_types`	array\|string\|null	stored only for `restaurant`/`cafe`; `null` clears
`phone`, `email`	string	contact details
`backdoor_capacity`	int	door capacity
`queue_skip_price`	number	queue-skip charge
`surge_threshold`, `surge_price`	number	surge pricing trigger + price
`last_entry_time`	string	e.g. `"02:00"`
`max_plus_ones`	int	default 3
`members_only`	int	0–2
`opening_hours`	object	validated; stored as JSON
`guest_list_enabled`	bool	enable guest-list bookings
`tables_enabled`	bool	enable table bookings
`paid_guest_list_enabled`	bool	charge for guest list
`booking_policy`	string\|null	default booking policy id
`website`, `description`	string	empty string clears
`marketing_sender_name`, `marketing_reply_to`	string	branded-email sender
`instagram_url`, `tiktok_url`, `twitter_url`	string	social links

Booking defaults (party size, duration, how far ahead and how late bookings can be made) live on the venue’s Table Access Profile, not on the venue itself - sending default_booking_duration, default_party_min/default_party_max, booking_cutoff_value/booking_cutoff_unit or booking_start_value/booking_start_unit here has no effect.

curl -X PUT "https://thesidedoor.co/api/my-venues/VENUE_ID" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tables_enabled":true,"guest_list_enabled":true,"last_entry_time":"02:00","website":"https://blueroom.example"}'

const res = await fetch("https://thesidedoor.co/api/my-venues/VENUE_ID", {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    tables_enabled: true,
    guest_list_enabled: true,
    last_entry_time: "02:00",
    website: "https://blueroom.example",
  }),
});
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID");
curl_setopt_array($ch, [
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "tables_enabled" => true,
    "guest_list_enabled" => true,
    "last_entry_time" => "02:00",
    "website" => "https://blueroom.example",
  ]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true }

Switch draft/live

PUT /api/my-venues/:id/status with { "status": "draft" | "live" }. Going live requires name, address, venue_type, email, a logo, and at least one configured shift - otherwise you get a 400 listing the missing fields. phone is optional. Going live also returns 402 if your account is suspended for an unpaid invoice (settle it in Billing first). Switching a live venue back to draft is blocked (409) while it has upcoming reservations.

curl -X PUT "https://thesidedoor.co/api/my-venues/VENUE_ID/status" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"status":"live"}'

const res = await fetch("https://thesidedoor.co/api/my-venues/VENUE_ID/status", {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ status: "live" }),
});
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/status");
curl_setopt_array($ch, [
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode(["status" => "live"]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true, "status": "live" }

Request or withdraw an app listing

A live venue can request to be listed in the Sidedoor consumer app. POST /api/my-venues/:id/request-listing moves app_listing_status to pending; POST /api/my-venues/:id/withdraw-listing withdraws a still-pending request back to none. Neither takes a body.

curl -X POST "https://thesidedoor.co/api/my-venues/VENUE_ID/request-listing" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN"

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/request-listing",
  {
    method: "POST",
    headers: { Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}` },
  },
);
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/request-listing");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer {$token}"],
]);
$data = json_decode(curl_exec($ch), true);

{ "app_listing_status": "pending" }

Venue stats

GET /api/my-venues/:id/stats returns revenue, booking counts and a 14-day chart for a single venue.

curl "https://thesidedoor.co/api/my-venues/VENUE_ID/stats" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN"

const res = await fetch("https://thesidedoor.co/api/my-venues/VENUE_ID/stats", {
  headers: { Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}` },
});
const stats = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/stats");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer {$token}"],
]);
$stats = json_decode(curl_exec($ch), true);

{
  "venue": { "id": "VENUE_ID", "name": "The Blue Room" },
  "revenue": { "today": 240, "week": 1680, "month": 7200, "alltime": 54000 },
  "bookings": { "pending": 3, "approved": 41, "cancelled": 2, "total": 46, "today_count": 5 },
  "unique_guests": 512,
  "chart": [{ "booking_date": "2026-06-20", "status": "approved", "count": 4 }]
}

Operator stats

GET /api/my-stats aggregates across all your venues.

curl "https://thesidedoor.co/api/my-stats" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN"

const res = await fetch("https://thesidedoor.co/api/my-stats", {
  headers: { Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}` },
});
const stats = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-stats");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer {$token}"],
]);
$stats = json_decode(curl_exec($ch), true);

{
  "venues": 3,
  "total_guests": 1840,
  "month_guests": 210,
  "revenue": 0,
  "partner": null
}

Upload a logo

POST /api/venues/:id/logo. As with all Sidedoor image uploads, send the image as a base64 data URL in a JSON field named data (multipart is not accepted). Max 2 MB. The response returns the stored logo_url. A logo is required before a venue can go live.

curl -X POST "https://thesidedoor.co/api/venues/VENUE_ID/logo" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"data":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..."}'

const res = await fetch("https://thesidedoor.co/api/venues/VENUE_ID/logo", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    data: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA...",
  }),
});
const { logo_url } = await res.json();

$dataUrl = "data:image/png;base64," . base64_encode(file_get_contents("logo.png"));
$ch = curl_init("https://thesidedoor.co/api/venues/VENUE_ID/logo");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode(["data" => $dataUrl]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true, "logo_url": "/assets/venue-logo/VENUE_ID/a1b2c3d4e5f6.png" }

Delete a logo

DELETE /api/venues/:id/logo removes the venue’s logo. Because a logo is required while a venue is live, this returns 400 if the venue is still live - switch it to draft first, then delete. It takes no body.

curl -X DELETE "https://thesidedoor.co/api/venues/VENUE_ID/logo" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN"

const res = await fetch("https://thesidedoor.co/api/venues/VENUE_ID/logo", {
  method: "DELETE",
  headers: { Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}` },
});
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/venues/VENUE_ID/logo");
curl_setopt_array($ch, [
  CURLOPT_CUSTOMREQUEST => "DELETE",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer {$token}"],
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true }