# Getir

> Getir is an Istanbul-based on-demand delivery company (founded 2015) that pioneered the ultrafast "groceries in minutes" model and grew into a super-app spanning rapid grocery, large-basket grocery, water, restaurant food delivery (GetirYemek / GetirFood) and local-merchant commerce (GetirÇarşı / GetirLocals). Its developer surface is a partner-integration platform for POS and integrator companies, not a public product API. In February 2026 Uber agreed to acquire Getir's Türkiye delivery business; the Turkish Competition Authority cleared the deal in June 2026.

Generated by the API Evangelist enrichment pipeline on 2026-07-31 from apis.yml and the artifacts in this repository. No provider-published llms.txt exists — /llms.txt returns 404 on the API hosts and an SPA HTML shell on developers.getir.com.

## APIs

- [GetirFood API](https://developers.getir.com/food/documentation/giris): Partner integration API for restaurant onboarding, menus, product/option availability, working hours, delivery zones, payment methods and the full food-order lifecycle. Swagger 2.0, version 1.5.8, 54 paths / 62 operations / 63 definitions. Base URL: https://food-external-api-gateway.getirapi.com

## Specs

- [GetirFood Swagger 2.0 (verbatim)](https://food-external-api-gateway.getirapi.com/swagger.json): the live published contract
- [GetirFood OpenAPI (YAML)](openapi/getir-food-openapi.yml): same document, YAML serialization
- [GetirFood original](openapi/_original/getir-food-openapi.json): harvested verbatim, never mutated
- [API Evangelist overlay](overlays/getir-food-overlay.yaml): our enhancements, applied over the original

## Docs

- [Developer portal](https://developers.getir.com/)
- [GetirFood integration documentation](https://developers.getir.com/food/documentation/giris)
- [GetirFood API reference (Swagger UI)](https://developers.getir.com/food/api-documentation)
- [Status page](https://getir-food-integration.instatus.com/)
- [Privacy policy](https://getir.com/yardim/gizlilik-politikasi/)
- Support: getiryemekapi@getir.com

## How it works

- **Authentication**: POST /auth/login with `appSecretKey` + `restaurantSecretKey` returns an opaque `token`, valid for 1 hour, sent as a `token` request header on all 57 authenticated operations. No OAuth, no OIDC, no scopes. Credentials are issued by Getir, not self-service.
- **Events**: orders are PUSHED to two partner-registered webhook URLs (new order, cancel order) by HTTP POST, authenticated with a shared `x-api-key`. Backup polling via /food-orders/periodic/unapproved and /food-orders/active. No AsyncAPI document is published.
- **Order lifecycle**: verify (status 400) or verify-scheduled (status 325) → prepare → handover (Getir courier, deliveryType 1) or deliver (restaurant courier, deliveryType 2). Orders must be answered within 30 seconds; the confirmation limit is 5 minutes; at least 1 minute must separate verify/prepare/deliver.
- **Rate limits**: 300 requests / 60 seconds per token by default (20s block); the restaurant + menu configuration surface is capped at 2 requests / 60 seconds (30s block); cancel-options at 40 / 600 seconds. /food-orders/periodic/* is exempt.
- **Errors**: proprietary `{code, error, message, details, source}` JSON envelope with a published 99-entry registry. Not RFC 9457.
- **Idempotency**: none. There is no idempotency key; retried transitions return domain errors rather than replaying.
- **Time**: all dates and times are GMT. Minimum TLS is 1.2.

## Artifacts

- [Authentication profile](authentication/getir-authentication.yml)
- [API conventions](conventions/getir-conventions.yml)
- [Error registry (99 codes)](errors/getir-error-codes.yml)
- [Rate limits (52 endpoints)](rate-limits/getir-rate-limits.yml)
- [Webhook catalog](asyncapi/getir-food-webhooks.yml)
- [Sandbox and test data](sandbox/getir-sandbox.yml)
- [Data model](data-model/getir-data-model.yml)
- [Lifecycle](lifecycle/getir-lifecycle.yml)
- [Changelog](changelog/getir-changelog.yml)
- [Conformance](conformance/getir-conformance.yml)
- [Packages](packages/getir-packages.yml)
- [MCP servers (community only)](mcp/getir-mcp.yml)
- [MCP tool crosswalk](mcp/getir-tool-crosswalk.yml)
- [Agent skills](skills/_index.yml)
- [Agentic access contracts](agentic-access/getir-agentic-access.yml)
- [Domain security](security/getir-domain-security.yml)
- [Well-known probe results](well-known/getir-well-known.yml)

## Not published by Getir

- No OpenAPI 3.x (Swagger 2.0 only), no GraphQL, no gRPC/protobuf
- No AsyncAPI document for the webhook surface
- No official MCP server and no A2A agent card
- No /.well-known/ documents on any host (no security.txt, no OIDC discovery, no api-catalog)
- No official client SDK in any package registry, and no CLI
- No deprecation policy, SLA, trust center, bug bounty or published compliance certifications
- No Postman collection or workspace