REST reference.

Returns 201 with the user plus an accessToken / refreshToken pair.

Returns an accessToken / refreshToken pair. If the account has 2FA enabled it instead returns { requires2fa: true, challengeToken, email } complete the login with POST /auth/2fa-verify.

Step 2 of a 2FA login. Returns the same accessToken / refreshToken pair as /auth/login.

Returns the same JWT pair as /auth/login no password ever exists.

Mints a fresh accessToken (and a rotated refreshToken) when the access token expires no re-login needed.

Revokes the refresh token so it can no longer mint new access tokens.

Returns published, public events as discovery cards with the lowest available ticket price.

Includes organizer info, schedule and active ticket types. Private events 404 to anonymous callers but stay visible to their own organization authenticate with an organizer JWT or the org’s API key.

Required: title, category, startDate, endDate, timezone, venueType and capacity every other field is optional. The event is created in draft status; add ticket types and publish it separately.

Partial update accepts every field from create, all optional; omitted fields keep their value. Date or venue changes to a published event notify ticket holders.

No body. Fails if required fields are missing or the event has no ticket types yet.

Cancels the event. Drafts simply disappear; published events make issued tickets eligible for refunds.

Returns each type with live availability available is null when quantityTotal is -1 (unlimited).

Returns 201 with the order plus a per-order accessToken for guest reads. Free orders complete instantly tickets are issued at creation.

nowpayments returns the generated crypto deposit details (payAddress, payAmount, payCurrency, network, payinExtraId); the redirect providers return an authorizationUrl to open. 409s: ALREADY_PAID, ORDER_NOT_PAYABLE, and NOTHING_TO_PAY for free orders.

Confirms the charge with the provider server-side and issues tickets. Idempotent and poll-safe call it after the buyer returns from checkout, or on an interval until status is completed.

Returns the order status, total, currency and the list of payment attempts (provider, status, amount). Read-only use /payments/verify to actively confirm and issue tickets.

Returns the live list of crypto coins NOWPayments can generate a deposit for (ticker, label, symbol) the source for the payCurrency value on /orders/{id}/pay. Cached ~10 minutes.

Pending / processing orders only releases held inventory. Paid orders go through the refund flow instead.

Fee: a 3% platform fee on the ticket face value is deducted from your org wallet for every NON-FREE (paid) ticket free tickets (price 0) incur NO fee and never touch the wallet. This is the reduced developer rate; paid orders bought through Zatabox checkout pay 5%. Flow: you collected the payment yourself, so we mint the tickets and a completed (externally-paid) order, then debit the 3% in the ticket currency fund the wallet first (Wallet → Fund). The whole issuance fails atomically with 402 INSUFFICIENT_FUNDS if the wallet can't cover the fee (nothing is minted). Honours the Idempotency-Key header so a retry never double-issues. Returns 201 with the order, the minted tickets and the exact fee charged.

Denials are 200s, not errors: status comes back success or denied_duplicate, denied_cancelled, denied_expired, denied_wrong_event, with a deniedReason field.

Ticket hashes + statuses a gate device caches locally, so it keeps admitting with zero connectivity.

Totals, capacity %, entry rate and per-gate breakdown. Per-gate slice: GET /checkin/event/{id}/gate/{gate}.

Server-Sent Events a stats snapshot every 2 seconds, keep-alive comments every 30. Point an EventSource at it.

Only checked-in tickets can review the pair ticketCode + email is the proof, no login needed.

Re-subscribes a prior opt-out; every announcement email carries a one-click unsubscribe link.

No payment at join time. When inventory frees up, the next entries get a time-limited purchase link.

Returns imported and skipped counts rows with invalid emails are skipped, not fatal.

Sends real email to every matching attendee; replies thread back to the organizer inbox.

Additive existing tags stay. Tags power broadcast tagFilter and CRM segments. DELETE the same path removes one.

No parameters. Returns one JSON download of everything on the account: profile, orders + items, tickets, refund requests, reports and message threads.

Eligibility = the ticket type’s refundable flag plus its deadline; the organizer approves or denies. 409 when not eligible.

harassment and fraud route straight to platform admins; the rest go to the organizer first.

Rate-limited to 10 messages per hour per organizer. Replies land in GET /users/me/messages.

The response returns the full plaintext secret EXACTLY ONCE only its prefix is stored afterwards. Send it as a Bearer token (Authorization: Bearer vt_live_…). Requires an organizer JWT (owner / admin).

Returns each key’s prefix, masked display, scopes, environment, status, last-used and expiry never the secret.

No body. Returns a new plaintext secret exactly once and invalidates the old one immediately.

Revokes the key it stops authenticating immediately.

The response contains the full whsec_ signing secret exactly once it is masked on every later read. Store it immediately.

Deliveries stop immediately and the signing secret is invalidated recreating issues a new one.

No body fires a signed test event at the URL so you can verify your handler end to end.

No body. Issues a new whsec_ signing secret and returns it exactly once (the old one stops verifying immediately). Store it right away it is masked on every later read.

Each delivery shows event type, response status, latency, retry count and the error detail on failures.

No auth, no parameters every event type the platform can emit, for building subscription UIs.