Add a tab to an online menu

POST/v1/sites/{siteId}/menus/{code}/tabs

Adds a tab, after the menu's others, with the products on it. The response is the whole menu.

Needs Catalogue: writeChanges live data

Path

• siteIdrequired

  The site, from GET /v1/sites.

  string

• coderequired

  The menu's code.

  string

Headers

• Authorizationrequired

  An API key from Automation > Access in the Dnero portal, sent as Authorization: Bearer <key>.

  string

• Idempotency-Key

  A value you choose, unique to what this request creates: a UUID, or your own id for it. Sending it again with the same body returns the first response and creates nothing more. Required.

  string · at most 255 characters

Body

• namerequired

  The tab's name.

  string · 1–100 characters

• products

  The products on the tab, by code, in order.

  array of string

Responses

• 201Created
• 400Bad Requestbad_requestinvalid_cursoridempotency_key_required
• 401Unauthorizedmissing_keyinvalid_keykey_expired+1 more
• 403Forbiddenkey_revokedassistant_keykey_without_access+7 more
• 404Not Foundsite_not_foundnot_found
• 409Conflictidempotency_key_reusedrequest_in_progress
• 422Unprocessable Entityinvalid_requestnot_a_modifier_group
• 429Too Many Requestsrate_limited
• 500Internal Server Errorserver_error
• 502Bad Gatewayupstream_unavailable

201 Created

• activerequired

  False for a retired menu.

  boolean

• coderequired

  The menu's code.

  string

• namerequired

  The menu's name, as customers see it.

  string

• orderrequired

  Where it sits among the site's menus, lowest first.

  integer

• orderTypesrequired

  The order types it serves, by code: a menu serving none appears nowhere.

  array of string

• tabsrequired

  Its tabs, in order.

  array of objects

  5 fields in each

  • coderequired

    The tab's code, within its menu.

    string

  • namerequired

    The tab's name.

    string

  • productsrequired

    The products on the tab, by code, in order.

    array of string

  • hoverImageUrl

    The picture shown under the cursor.

    string · uri

  • imageUrl

    The tab's picture.

    string · uri

• updatedAt

  When it last changed.

  string · date-time

curlJavaScriptPython

curl -X POST "https://api.dev.dnerohq.com/v1/sites/{siteId}/menus/{code}/tabs" \
  -H "Authorization: Bearer $DNERO_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Coffee",
  "products": [
    "7b3e9c14-2a6f-4d08-8b5e-c1f4a7d2e936"
  ]
}'

const response = await fetch('https://api.dev.dnerohq.com/v1/sites/{siteId}/menus/{code}/tabs', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.DNERO_API_KEY}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Coffee",
    "products": [
      "7b3e9c14-2a6f-4d08-8b5e-c1f4a7d2e936"
    ]
  }),
})
const data = await response.json()

import os, uuid
import requests

response = requests.post(
    "https://api.dev.dnerohq.com/v1/sites/{siteId}/menus/{code}/tabs",
    headers={"Authorization": f"Bearer {os.environ['DNERO_API_KEY']}", "Idempotency-Key": str(uuid.uuid4())},
    json={
      "name": "Coffee",
      "products": [
        "7b3e9c14-2a6f-4d08-8b5e-c1f4a7d2e936"
      ]
    },
)
data = response.json()

201Createdapplication/json

{
  "active": true,
  "code": "0c4b2e81-7a3f-4d9e-b6c5-2f8a1d0e7b43",
  "name": "All day",
  "order": 1,
  "orderTypes": [
    "e2b7c4f9-3a1d-4c6e-9f80-5d2a7b1c4e38"
  ],
  "tabs": [
    {
      "code": "t-1f3a",
      "hoverImageUrl": "https://ucarecdn.com/5d7b2e9a-1c4f-4a86-9e03-b6f1a8c4d270/",
      "imageUrl": "https://ucarecdn.com/8c1e4a7d-2f5b-4d90-b3e6-0a9c7d2f5e18/",
      "name": "Coffee",
      "products": [
        "7b3e9c14-2a6f-4d08-8b5e-c1f4a7d2e936"
      ]
    }
  ],
  "updatedAt": "2026-10-20T03:15:00Z"
}

400Bad Requestapplication/problem+json

{
  "type": "https://developers.dnerohq.com/guides/errors/#bad_request",
  "title": "Bad Request",
  "status": 400,
  "detail": "The request could not be read, for example malformed JSON.",
  "code": "bad_request"
}

401Unauthorizedapplication/problem+json

{
  "type": "https://developers.dnerohq.com/guides/errors/#missing_key",
  "title": "Unauthorized",
  "status": 401,
  "detail": "No API key was sent.",
  "code": "missing_key"
}

403Forbiddenapplication/problem+json

{
  "type": "https://developers.dnerohq.com/guides/errors/#key_revoked",
  "title": "Forbidden",
  "status": 403,
  "detail": "The key was revoked or switched off in the Dnero portal.",
  "code": "key_revoked"
}

404Not Foundapplication/problem+json

{
  "type": "https://developers.dnerohq.com/guides/errors/#site_not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "The key does not reach that site, or there is no such site.",
  "code": "site_not_found"
}

409Conflictapplication/problem+json

{
  "type": "https://developers.dnerohq.com/guides/errors/#idempotency_key_reused",
  "title": "Conflict",
  "status": 409,
  "detail": "This `Idempotency-Key` was already used for a different request.",
  "code": "idempotency_key_reused"
}

422Unprocessable Entityapplication/problem+json

{
  "type": "https://developers.dnerohq.com/guides/errors/#invalid_request",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "The request was read but is not valid.",
  "code": "invalid_request"
}

429Too Many Requestsapplication/problem+json

{
  "type": "https://developers.dnerohq.com/guides/errors/#rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "The key has used its requests for this minute.",
  "code": "rate_limited"
}

500Internal Server Errorapplication/problem+json

{
  "type": "https://developers.dnerohq.com/guides/errors/#server_error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "Something went wrong on Dnero's side. It has been logged.",
  "code": "server_error"
}

502Bad Gatewayapplication/problem+json

{
  "type": "https://developers.dnerohq.com/guides/errors/#upstream_unavailable",
  "title": "Bad Gateway",
  "status": 502,
  "detail": "Something Dnero depends on did not answer in time.",
  "code": "upstream_unavailable"
}

Examples use this site's API host. Keep the key in $DNERO_API_KEY; never paste it into code.