API Reference

Overview

CompleteEvent has a REST API for building a direct integration — creating registrations, checking attendees in, sending broadcasts, and reading event data from your own code. The same API powers the Zapier integration, so if you only need to connect to another app, start with the Zapier integration instead.

This page covers authentication, scopes, errors, rate limits, and webhook verification. For the full endpoint catalog with request and response examples, see the API Reference.

The API is available on the Starter, Pro, and Enterprise plans. Requests from free-plan organizations are rejected with a 403.

Base URL

https://completeevent.app/api/zapier

Authentication

Generate an API key in Organization Settings → API Keys. Each key is scoped to one organization and is shown only once — store it somewhere safe. Send it as a Bearer token on every request:

Authorization: Bearer ce_live_your_key_here

Requests with a missing or invalid key return 401.

Scopes

Each key has one of two scopes, chosen when you create it:

• Read — read-only endpoints (list events, find a registration). Write endpoints return 403 This API key is read-only.
• Read & write — everything, including creating registrations, checking attendees in, cancelling, and sending broadcasts.

Rotating and revoking keys

Revoking a key stops it working immediately. Rotating a key issues a new key but keeps the old one valid for 24 hours, so you can update your integration without downtime. After 24 hours the old key stops working.

Errors

Errors return a JSON body of the form { "error": "..." } with these status codes:

• 400 — missing or invalid request fields.
• 401 — missing, invalid, or revoked API key.
• 403 — the key is read-only, or the organization's plan does not include API access.
• 404 — the event or registration was not found (or belongs to another organization).
• 409 — the action conflicts with current state (for example, the event is at capacity).
• 429 — rate limit exceeded. Retry after the number of seconds in the Retry-After response header.

Rate limits

Requests are limited per API key and per IP address. When you exceed a limit the API returns 429 with a Retry-After header (in seconds). Back off and retry after that interval rather than retrying immediately.

Idempotency

Creating a registration is idempotent on the event and email address: if you call create-registration again for the same attendee and event, the existing registration is returned (with "duplicate": true) instead of creating a second one. This makes it safe to retry a failed request.

Webhooks

Instead of polling, you can register webhook endpoints that CompleteEvent posts to in real time (a registration is confirmed, an attendee checks in, a payment lands). Configure them in Organization Settings → Webhooks. See Webhooks for the full list of event types and the payload format.

Verifying webhook signatures

Every webhook request includes an X-CompleteEvent-Signature header — the HMAC-SHA256 of the exact request body, keyed with your endpoint secret. Recompute it and compare using a constant-time check, then reject any request that does not match.

import crypto from "node:crypto";

function verify(rawBody, signatureHeader, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader),
  );
}

Verify against the raw request bytes, not a re-serialized JSON object — re-encoding can change whitespace or key order and break the signature. The Webhooks settings page has ready-to-copy samples for Node, Python, and PHP.