> ## Documentation Index > Fetch the complete documentation index at: https://docs.listo.delivery/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Notes on the Listo Partner Delivery API: > - Every endpoint is under `https://api.listo.delivery/v1/` and authenticates with a bearer API key. > - This documentation site is at https://docs.listo.delivery. The full machine-readable reference is the OpenAPI document at https://api.listo.delivery/docs/openapi.yaml (served by the API host, not by this site). > - Any page of this site is also available as raw markdown by appending `.md` to its URL, for example https://docs.listo.delivery/en/guides/webhooks.md. The index of every page is https://docs.listo.delivery/llms.txt and all of them in one file is https://docs.listo.delivery/llms-full.txt. > - Every page is published in English under https://docs.listo.delivery/en/ and in Spanish under https://docs.listo.delivery/es/, with the same path after the language. The API reference is under https://docs.listo.delivery/api-reference/ in English and https://docs.listo.delivery/es/api-reference/ in Spanish. > - To debug an integration yourself: `GET /v1/request_logs` lists the calls your keys made with what you sent and what was answered, `GET /v1/events` lists the events Listo emitted, `GET /v1/webhook_deliveries` lists every attempt to deliver them, `POST /v1/events/{id}/resend` sends one event again and `POST /v1/test_webhooks` sends a sample event (`"test": true`). The page https://docs.listo.delivery/en/guides/debugging describes them. A resent event is a snapshot from when it happened; `GET /v1/deliveries` is still how you recover current state. > - Every error response has `error.doc_url`, a page that explains that error code and what to do, and `error.request_id`, the same value as the `X-Request-Id` response header. All the pages are listed at https://docs.listo.delivery/en/errors. Filter `GET /v1/request_logs` with `request_id` to read the logged call. > - A `409 account_exists` from `POST /v1/stores` means the restaurant already has its own Listo account: connect it instead of creating it, as the page https://docs.listo.delivery/en/guides/connect-existing-account describes. > - Every live store carries one Plan Listo, charged to the partner. The exception is a connected restaurant that had already paid its current month: it keeps paying its own plan until its next renewal, shown as `paid_by: "store"` with the handover date in `pending_paid_by_on`. A `402 plan_required` from a quote, a delivery create or a retry means the store's plan is not paid or has ended; the page https://docs.listo.delivery/en/guides/plan-and-billing describes the plan, the `plan` block on a store and how to end or restart it. > - An AI assistant (Claude Code, Cursor, Codex) can act through the same API key at `https://api.listo.delivery/mcp`, an MCP server over Streamable HTTP authenticated with `Authorization: Bearer `. Every tool runs the matching `/v1/` endpoint, and each one that moves money first previews and then needs a confirmation token; the page https://docs.listo.delivery/en/guides/connect-ai-client lists the tools and describes the two steps. # Ask a restaurant to connect its account > Starts the flow that connects a restaurant's EXISTING Listo account to you, and returns the link to put in front of its owner. Send the owner's email address and one of the redirect URIs registered for your account. We resolve the restaurant ourselves and tell you nothing about it: the response is a link and a deadline, and you learn which account you connected only if the owner approves. Send them to `url`. They sign in with the Listo credentials they already have, see who is asking and what it grants, and either approve or cancel. We then send their browser back to your `redirect_uri`: approved `?code=pcc_...&state=...` exchange the code at `POST /v1/connections` cancelled `?error=access_denied&state=...` `state` is your own opaque value, echoed back untouched. Use it to tie the browser that comes back to the session that left; a redirect with no `state` you recognise is one you should not act on. The link is good for 30 minutes. Minting another is free, so treat an expired one as a button to render again rather than an error to handle. This endpoint is live-mode only. A test key gets `404`: there is no test version of a real restaurant's real account. ## OpenAPI ````yaml /openapi/en.yaml post /v1/connect_requests openapi: 3.1.0 info: title: Listo Delivery API version: 1.34.0 description: | Quote a delivery, dispatch it, and follow it to the door. Every request authenticates with a bearer API key. The key itself decides the world it acts in: a test key dispatches simulated couriers and moves no money, a live key dispatches real ones. A key can also be read-only: it may call GET and HEAD and nothing else, and any other call answers `403 read_only_key`. Money is always in Mexican pesos and always in integer cents, and every timestamp is ISO-8601 in UTC. Ids are opaque prefixed strings (`st_` a store, `qt_` a quote, `dlv_` a delivery, `wd_` a withdrawal, `evt_` an event, `le_` a ledger entry, `whd_` a webhook delivery attempt, `req_` a logged request). Treat them as strings of unbounded length and never parse them. Changes to v1 are additive: new fields and new enum values can appear, so ignore what you do not recognise rather than failing on it. servers: - url: https://api.listo.delivery security: [] tags: - name: Authentication description: Checking that a key works before you build against it. - name: Stores description: The pickup locations you dispatch from. - name: Account connection description: Connecting a restaurant's existing Listo account to you. - name: Quotes description: What a delivery costs, priced and held. - name: Deliveries description: Dispatching an order and following it to the door. - name: Balance description: The prepaid balance your deliveries draw on. - name: Withdrawals description: Moving money out of that balance to your bank. - name: Card onboarding description: Connecting the account that takes card payments. - name: Events description: >- The events Listo sent you, resending one, and sending a test event to your endpoint. - name: Webhook deliveries description: >- Every attempt Listo made to send an event to your endpoint, and what came back. - name: Request logs description: >- Every call your keys made to this API, with what you sent and what we answered. paths: /v1/connect_requests: post: tags: - Account connection summary: Ask a restaurant to connect its account description: | Starts the flow that connects a restaurant's EXISTING Listo account to you, and returns the link to put in front of its owner. Send the owner's email address and one of the redirect URIs registered for your account. We resolve the restaurant ourselves and tell you nothing about it: the response is a link and a deadline, and you learn which account you connected only if the owner approves. Send them to `url`. They sign in with the Listo credentials they already have, see who is asking and what it grants, and either approve or cancel. We then send their browser back to your `redirect_uri`: approved `?code=pcc_...&state=...` exchange the code at `POST /v1/connections` cancelled `?error=access_denied&state=...` `state` is your own opaque value, echoed back untouched. Use it to tie the browser that comes back to the session that left; a redirect with no `state` you recognise is one you should not act on. The link is good for 30 minutes. Minting another is free, so treat an expired one as a button to render again rather than an error to handle. This endpoint is live-mode only. A test key gets `404`: there is no test version of a real restaurant's real account. operationId: createConnectRequest requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateConnectRequestRequest' example: owner_email: rosa@lataqueria.mx redirect_uri: https://partner.example.com/listo/callback state: sess-8f21 required: true responses: '201': description: Created. content: application/json: schema: $ref: '#/components/schemas/ConnectRequest' example: url: >- https://admin.listo.delivery/connect/pcr_6mT4qX8vN2kR7bW1cZ5sLdYe expires_at: '2026-08-10T21:07:29Z' '403': description: >- The key is valid and is read-only (`read_only_key`), so it can read but not create, change or cancel anything. Use a key issued without the read-only setting. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: read_only_key: value: error: code: read_only_key message: >- This API key is read-only. Use a key without the read-only setting to create, change or cancel anything. param: null retryable: false doc_url: https://docs.listo.delivery/en/errors/read_only_key request_id: 0b1f6c9a-7e2d-4c53-9a41-5d8e3f2a6b10 '404': description: >- No object with that id exists for this key (`not_found`). Another account's objects are indistinguishable from ones that never existed. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: code: not_found message: No resource with that id exists for this API key. param: null retryable: false doc_url: https://docs.listo.delivery/en/errors/not_found request_id: 0b1f6c9a-7e2d-4c53-9a41-5d8e3f2a6b10 '422': description: >- The request was understood and refused. `error.code` says why and `error.param` names the offending field when one applies. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: code: validation_failed message: >- No Listo account signs in with that email address. Create the store instead. param: owner_email retryable: false doc_url: https://docs.listo.delivery/en/errors/validation_failed request_id: 0b1f6c9a-7e2d-4c53-9a41-5d8e3f2a6b10 security: - BearerAuth: [] components: schemas: CreateConnectRequestRequest: type: object description: The restaurant owner to ask, and where to send them back. properties: owner_email: type: string description: >- The email of the person who signs in to the restaurant's Listo account. redirect_uri: type: string description: Where the owner's browser returns after approving. state: type: string maxLength: 255 description: >- An opaque value returned to `redirect_uri` unchanged, up to 255 characters. required: - owner_email - redirect_uri ConnectRequest: type: object description: A connection request waiting for the restaurant owner to approve it. properties: url: type: string format: uri description: The consent page to send the owner to. expires_at: type: string format: date-time description: When the link stops working. required: - url - expires_at ErrorResponse: type: object description: The body of every 4xx and 5xx answer on this API. properties: error: $ref: '#/components/schemas/Error' required: - error Error: type: object description: | What every refusal and every failure looks like. `code` is the only field to branch on; `message` is for a human reading a log and may change wording or language without notice. properties: code: type: string description: | A stable, machine-readable name for what went wrong, such as `validation_failed`, `not_found` or `insufficient_balance`. Branch on this and never on `message`. The set grows additively: handle a code you do not know as the generic failure its status code says it is. Every code has a page under `doc_url`. example: validation_failed message: type: string description: | A sentence for the person debugging. Free to change wording or language, so never match on it. example: order_value_cents is required. param: type: - string - 'null' description: | The request field the refusal is about, when one applies, spelled as you sent it (`dropoff.street`, `manifest.items`). Null when the failure is not about one field. example: order_value_cents retryable: type: boolean description: | Whether sending the identical request again could succeed. `false` means it never will without a change on your side or in the world. example: false doc_url: type: string format: uri description: The documentation page for this `code`. example: https://docs.listo.delivery/en/errors/validation_failed request_id: type: string description: | Our id for this request, the same value as the `X-Request-Id` response header. Quote it to support, and filter `GET /v1/request_logs` by it. example: 0b1f6c9a-7e2d-4c53-9a41-5d8e3f2a6b10 required: - code - message - param - retryable - doc_url - request_id securitySchemes: BearerAuth: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. Live and test keys are separate; the key you send decides which world the call acts in. To try calls, use a test key (it starts with `lst_test_`): no real courier is sent and no real money moves, but webhooks fire and the `dropoff.phone` you give can receive WhatsApp messages, so use your own number. A live key (it starts with `lst_live_`) books and charges real deliveries. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.