API Access

Getting an API Key

1. Go to Admin Dashboard → Settings
2. Scroll to the API Keys section
3. Click "Generate New Key" and give it a descriptive name
4. Copy the generated key immediately — it is only shown once

Authentication

All requests must include your API key in the x-api-key header:

curl -H "x-api-key: knmi_your_key_here" \
  "https://hbyaeoqwllejvvcajxkd.supabase.co/functions/v1/event-data-api?resource=event"

Base URL

Available Resources

Each API key is scoped to your organization. By default, every resource returns data across all events in your org. Add the optional event_id filter only when you want to narrow to a single event.

GET ?resource=event

GET ?resource=event&event_id=YOUR_EVENT_ID

GET ?resource=participants

GET ?resource=participants&event_id=YOUR_EVENT_ID

GET ?resource=sessions

GET ?resource=sessions&event_id=YOUR_EVENT_ID

GET ?resource=tickets

GET ?resource=tickets&event_id=YOUR_EVENT_ID

GET ?resource=checkins

GET ?resource=checkins&event_id=YOUR_EVENT_ID

Response Format

All responses are JSON with the following structure:

{
  "data": [...],
  "resource": "participants",
  "organization_id": "uuid"
}

JavaScript Example

const API_KEY = "knmi_your_key_here";
const BASE_URL = "https://hbyaeoqwllejvvcajxkd.supabase.co/functions/v1/event-data-api";

async function getEventData(resource, eventId) {
  const params = new URLSearchParams({ resource });
  if (eventId) params.set("event_id", eventId);

  const response = await fetch(`${BASE_URL}?${params}`, {
    headers: { "x-api-key": API_KEY },
  });

  if (!response.ok) {
    throw new Error(`API error: ${response.status}`);
  }

  return response.json();
}

// Usage
const { data: participants } = await getEventData("participants", "your-event-id");
console.log(`Found ${participants.length} participants`);

Error Codes

Webhooks

Webhooks let you receive real-time HTTP POST notifications when events happen in your organization.

Setup

1. Go to Admin Dashboard → Settings → Webhooks
2. Click "Add Webhook"
3. Enter your endpoint URL and select which events to subscribe to
4. A signing secret is generated automatically — use it to verify payloads

Available Events

Payload Format

{
  "event": "participant.created",
  "timestamp": "2026-04-15T12:00:00.000Z",
  "data": {
    "id": "uuid",
    "full_name": "Jane Doe",
    "email": "jane@example.com",
    "event_id": "uuid"
  }
}

Verifying Signatures

Each webhook request includes an X-Webhook-Signature header — an HMAC-SHA256 hex digest of the request body using your signing secret.

import crypto from "crypto";

function verifySignature(body, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(body)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

Rate Limiting

The API enforces a rate limit of 100 requests per minute per API key. Every response includes rate limit headers:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 97
X-RateLimit-Reset: 1713200160

• X-RateLimit-Limit — Maximum requests allowed per window
• X-RateLimit-Remaining — Requests remaining in the current window
• X-RateLimit-Reset — Unix timestamp when the window resets

If you exceed the limit, you'll receive a 429 Too Many Requests response with a Retry-After header indicating how many seconds to wait.

Best Practices

• Use the event_id filter to reduce response size when you only need data for one event
• Cache responses where appropriate to minimize API calls
• Respect rate limit headers — back off when X-RateLimit-Remaining is low
• Store your API key in environment variables, not in source code
• Create separate keys for different integrations so you can revoke them independently
• Monitor the "Last used" timestamp in your admin settings to track key usage