Cloomba API
Read your events, attendees, and registration answers — pull your agenda, speakers, sponsors, photos, and ticket prices — and check guests in, over a simple REST API.
The public API is still under development. The list of endpoints will grow over time — following our roadmap and on request.
What you can do
A key acts as you, the organizer. Use it to list the events you host, read their attendee lists with typed registration answers, and check people in at the door. It reaches only your own events — never anyone else's data.
Base URL
All endpoints are relative to a single base URL:
https://api.cloomba.com/public/v1
Authentication
Send your API key as a Bearer token on every request. Keys are created in your account under Developers, where you also choose the key's scope.
curl -H "Authorization: Bearer cloomba_sk_..." \ https://api.cloomba.com/public/v1/events
Scopes
A key's scope is fixed when it is created:
- readEvery read endpoint below.
- read_writeAdditionally allows every write operation — creating and updating events, setting a cover, and checking a guest in. A key restricted to specific events can update those events, but cannot create new ones.
Polling for changes
Both list endpoints accept ?since=, so a sync job can fetch only what changed instead of re-reading everything. Each response carries a timestamp — store it and send it back as the next since. Your own clock never enters the picture.
curl -H "Authorization: Bearer cloomba_sk_..." \ "https://api.cloomba.com/public/v1/events/my-event/attendees?since=2026-10-01T08:00:00Z"
A delta reports registrations that were created or changed — a check-in and an approval both count. Deletions are not reported.
Rate limits
- 60 requests per minute (burst) per key.
- 10,000 requests per day per account.
Exceeding either returns 429 rate_limited.
Errors
Every error carries a stable snake_case code. Branch on the code, never on the human-readable message — codes are never renamed or reused.
| Code | HTTP | Meaning |
|---|---|---|
| api_key_invalid | 401 | Missing or invalid API key. |
| api_key_revoked | 401 | The key was revoked or has expired. |
| api_pro_required | 403 | This account is not eligible to write. See Developers. |
| api_scope_forbidden | 403 | The key can't reach this event, or a read key attempted a write. |
| validation_failed | 400 | A parameter or body field is invalid, or unknown. |
| rsvp_not_found | 404 | No registration matches that token. |
| event_not_found | 404 | No such event. |
| slug_taken | 409 | That event URL is already in use. |
| external_id_taken | 409 | Another of your events already uses that external_id. |
| cover_fetch_failed | 422 | The cover image could not be fetched from that URL. |
| rate_limited | 429 | Over the rate limit — slow down. |
A note on attendee data: an attendee's email and phone are the values that person consented to share for that registration — never their account contact details. Custom-question answers are typed (an options answer is an array of strings, a checkbox / terms answer is a boolean, everything else is a string). Lists are paginated with limit / offset and report a total.
Endpoints
- GET/eventsList your events. Add ?since= for only what changed.
- POST/eventsCreate an event, or upsert on your external_id (read_write).
- GET/events/{slug}One event with guest counts and questions.
- PATCH/events/{slug}Update an event (read_write).
- PUT/events/{slug}/coverSet the cover from a URL or preset (read_write).
- DELETE/events/{slug}/coverRemove the cover (read_write).
- GET/events/{slug}/attendeesThe full registration list with answers. Add ?since= for a delta.
- GET/events/{slug}/attendees/{qr_token}Look up one registration.
- GET/events/{slug}/featuredSpeakers, sponsors, hosts — filter by kind.
- GET/events/{slug}/sessionsThe agenda, with speakers on each session.
- GET/events/{slug}/mediaWall photos and videos.
- GET/events/{slug}/ticket-typesTicket tiers, prices, seats left.
- POST/events/{slug}/check-inCheck a guest in (read_write).
- GET/cover-presetsThe bundled cover library.