Events API

Event management endpoints

20 endpoints.

GET /api/events

optionalAuth. What comes back depends on who is asking in THIS community:

• A moderator sees every event.
• An APPROVED member sees every event except other people's drafts.
• A guest, or a signed-in non-member, gets only PUBLISHED events opted into guest preview, and only in a PUBLIC community whose plan includes it.
• Anyone else gets an empty page. Guests receive a reduced event: no meeting link or passcode, no attendee list, no attachments. Attendee emails go to moderators only. All event routes sit behind the router-level feature gate requireFeature(events): a plan without it gets 403 FEATURE_NOT_AVAILABLE on every route, reads included.

Auth: optional — a token changes what you can see (see "Who may read what").

Parameters

Responses

POST /api/events

Needs an APPROVED member holding calendar:manage or calendar:create, who is not suspended or blocked from events. The community is the one the guards checked (?communityId= or X-Tenant-Id). A body communityId that disagrees is refused with 400 COMMUNITY_MISMATCH. Uploads count against the plan's storage and are refused over the cap. Rate limit: 10 per burst, 1 per 5 seconds. All event routes sit behind the router-level feature gate requireFeature(events): a plan without it gets 403 FEATURE_NOT_AVAILABLE on every route, reads included.

Auth: Bearer JWT required.

Parameters

Request body (required) — multipart/form-data

Responses

DELETE /api/events/{id}

Same access rules as PUT. Nobody is notified. To tell attendees, set status=CANCELLED with PUT instead.

Auth: Bearer JWT required.

Parameters

Responses

GET /api/events/{id}

optionalAuth, with the same visibility as the list: another member's draft, or any event a guest may not preview, answers 404 exactly as a missing id does. Guests get the reduced event. Attendee emails go to moderators only. The creator's email is visible to members (intended). All event routes sit behind the router-level feature gate requireFeature(events): a plan without it gets 403 FEATURE_NOT_AVAILABLE on every route, reads included.

Auth: optional — a token changes what you can see (see "Who may read what").

Parameters

Responses

PUT /api/events/{id}

The event's creator, or a holder of calendar:manage or calendar:moderate. Either way the caller must be an APPROVED member who is not suspended or blocked from events. calendar:create alone does not let you edit other people's events. Only the fields you send change.

• A link is checked only when you change it, so an old link stays savable.
• existingAttachments selects which current attachments to keep, by id or url; the server's copy is kept, never yours.
• removeAttachments (or removeAttachmentIds) removes attachments by id.
• removeCover=true clears the cover. Bytes are recorded, but an edit is never refused over the storage cap. Setting status=CANCELLED, or moving the start date, notifies the attendees who are still members.

Auth: Bearer JWT required.

Parameters

Request body — multipart/form-data

Responses

DELETE /api/events/{id}/attend

Same access rules as POST. Keeps your interest bookmark. Auth: Bearer JWT required.

Parameters

Responses

POST /api/events/{id}/attend

Any APPROVED member who is not suspended or blocked from RSVPs, on an event they can open (another member's draft answers 404 and nothing is written). GOING is refused with 400 "Event capacity reached" when the seats are taken. Re-confirming a seat you already hold always succeeds. The event comes back at the caller's own visibility.

Auth: Bearer JWT required.

Parameters

Request body — application/json

Responses

PATCH /api/events/{id}/attendance

Needs an APPROVED member holding calendar:manage or calendar:moderate. A moderator decision, so it is not held to capacity. The member must already have a response row.

Auth: Bearer JWT required.

Parameters

Request body (required) — application/json

Responses

GET /api/events/{id}/attendance/stats

Needs an APPROVED member holding calendar:manage or calendar:moderate. maybe is the interested count. notGoing excludes interest-only bookmarks.

Auth: Bearer JWT required.

Parameters

Responses

GET /api/events/{id}/attendees

Everyone with a response row, optionally filtered by ?status=GOING,MAYBE,NOT_GOING. Any APPROVED member may call it, but the caller must be able to open the event, so another member's draft answers 404. Lists current APPROVED members only. The email field is filled for moderator-tier callers only and is null for everyone else.

Auth: Bearer JWT required.

Parameters

Responses

GET /api/events/{id}/attendees/export.csv

CSV (UTF-8 with BOM): name, status (going / maybe / not going / interested / waitlisted), waitlist position, registration time (UTC), and email for the moderator tier (the in-app roster's rule). Current members only. Every export is recorded.

Auth: Bearer JWT required.

Parameters

Responses

GET /api/events/{id}/confirmed

The GOING list. Any APPROVED member may call it, but the caller must be able to open the event, so another member's draft answers 404. Lists current APPROVED members only. The email field is filled for moderator-tier callers only and is null for everyone else.

Auth: Bearer JWT required.

Parameters

Responses

POST /api/events/{id}/interest

Independent of the RSVP, and the same access rules as POST /attend. The creator is notified when interest is added, as long as the creator is still a member.

Auth: Bearer JWT required.

Parameters

Responses

GET /api/events/{id}/interested

The heart / bookmark list. Any APPROVED member may call it, but the caller must be able to open the event, so another member's draft answers 404. Lists current APPROVED members only. The email field is filled for moderator-tier callers only and is null for everyone else.

Auth: Bearer JWT required.

Parameters

Responses

DELETE /api/events/{id}/waitlist

Auth: Bearer JWT required.

Parameters

Responses

GET /api/events/{id}/waitlist

Auth: Bearer JWT required.

Parameters

Responses

POST /api/events/{id}/waitlist

Only when the event is published, not over, free, has a seat limit and every seat is taken. When a seat frees up the first person in line is moved to GOING automatically and notified. 409 codes: EVENT_HAS_SEATS, ALREADY_GOING, EVENT_NOT_OPEN, NO_CAPACITY, EVENT_NOT_FREE.

Auth: Bearer JWT required.

Parameters

Responses

GET /api/events/{id}/waitlist/me

Auth: Bearer JWT required.

Parameters

Responses

GET /api/events/user/{userId}

Needs an APPROVED member holding calendar:manage or calendar:moderate. Auth: Bearer JWT required.

Parameters

Responses

GET /api/events/user/{userId}/attendance

Needs an APPROVED member holding calendar:manage or calendar:moderate. Auth: Bearer JWT required.

Parameters

Responses