Start
Authentication, scopes and limits
How keys, scopes, rate limits, idempotency and errors work.
Keys
Keys look like eos_live_… or eos_test_… and are sent as a Bearer token. Both act on your real data; the test label only helps you keep integrations apart. Keys inherit the permissions of the admin who created them and stop working if that person leaves the organisation.
Scopes
| Scope | Allows |
|---|---|
| events:read | GET /events, /events/{id}, /events/{id}/ticket-types |
| orders:read | GET /events/{id}/orders, /orders/{id} |
| attendees:read | GET /events/{id}/attendees, /attendees/{id} |
| attendees:write | POST /events/{id}/registrations |
| checkin:write | POST /check-ins |
Rate limits
Per key, per minute: 120 on Pay as you go, 600 on Pro, 2000 on Enterprise. Over the limit you receive HTTP 429 with code rate_limited; back off and retry after a minute.
Idempotency
Send an Idempotency-Key header on POST requests. A repeated key with the same body returns the original response; the same key with a different body returns 409 idempotency_conflict. Keys are kept for 24 hours.
Pagination
List endpoints take page and limit and return page, limit, total, has_more and next_page alongside data. Use updated_since (ISO 8601) on orders and attendees to sync incrementally.
Errors
{ "error": { "code": "invalid_request", "message": "Expected a UUID", "fields": { "ticket_type_id": "Invalid uuid" } } }| HTTP | code |
|---|---|
| 400 | invalid_request, invalid_json |
| 401 | unauthorized, key_revoked, key_orphaned |
| 403 | insufficient_scope, forbidden |
| 404 | not_found |
| 409 | conflict, idempotency_conflict |
| 429 | rate_limited |
| 503 | unavailable |